ClickOnce security and download on demand

re: ClickOnce security and download on demand

6767 — Sat, 22 May 2004 11:16:00 GMT

675675676767

re: ClickOnce security and download on demand

Peter Bernhardt — Mon, 31 May 2004 20:29:00 GMT

I'm looking at the CTP May release and I've found a number of quirks I'm hoping you might talk about in some detail.

First, in my first tests I had to strong name sign the application itself and build it before I could publish without generating errors.

I've also seen some erratic behavior with the publish wizard, whereby VS creates a publish folder in the project folder and sticks all the files there; it doesn't create a virtual directory on IIS.

If I publish directly, I have to check the output window to make sure the application was actually published. It would be nice if the IDE generated a warning or threw up a prompt to let me know that the published application was already up-to-date. And on that note, why can't I force a republish from within the IDE without having to change versions of the application or deployment manifest?

Also, I recall hearing somewhere between the Oct. '03 PDC and now (can't recall where) that strong name signing support was going to be dropped for one or both of the manifests. Am I imagining things or not?

re: ClickOnce security and download on demand

Sampy — Tue, 01 Jun 2004 17:00:00 GMT

Thanks for your interest Peter!

"First, in my first tests I had to strong name sign the application itself and build it before I could publish without generating errors."

This will not be the case for the final release; the most common case we envision is ClickOnce deploying simply named apps. I haven't run into this particular behavior (which definitely seems like a bug, we do a build when you publish so we shouldn't need one before hand). What you may be running afoul of is the confusing UI of the signing page. Uncheck the sign assembly checkbox and enter a key. This will sign the manifests but not the assembly. We hope to take another crack at this UI before release but no promises (if we don't, expect a blog post about what's going on in there).

"I've also seen some erratic behavior with the publish wizard, whereby VS creates a publish folder in the project folder and sticks all the files there; it doesn't create a virtual directory on IIS."

Not creating the folder on IIS is probably a bug but creating the publish folder on disk is not. Think of it as the obj folder for your deployment. After we create the manifests, we have to do some fixup to accommodate the directory structure of your deployment.

"If I publish directly, I have to check the output window to make sure the application was actually published. It would be nice if the IDE generated a warning or threw up a prompt to let me know that the published application was already up-to-date. And on that note, why can't I force a republish from within the IDE without having to change versions of the application or deployment manifest?"

You should be able to publish without changing the versions by unchecking the auto-increment version checkbox on the publish property page. Also, you should be seeing a warning if you try to publish the same version or a previous version to the same location (VS goes out and sniffs your manifest before we copy up the files). I'll bring up this feedback with my team.

"Also, I recall hearing somewhere between the Oct. '03 PDC and now (can't recall where) that strong name signing support was going to be dropped for one or both of the manifests. Am I imagining things or not?"

Manifests have to be signed in the CTP's and they'll have to be signed in the Beta. Beyond that I can't promise anything (my team isn't in charge of that stuff and even if they were, I don't run my team :)) but I would imagine that this will not change.

re: ClickOnce security and download on demand

Peter Bernhardt — Thu, 03 Jun 2004 17:42:00 GMT

Thanks for the response, Mike. Including a copy of the publish folder makes sense as you explain it.

And yeah, I'll look forward to a more logical UI presentation for adding a key to sign the manifests. But overall, I really like the App Designer. It's an excellent ehancement to the IDE.

Getting back to my problems publishing ClickOnce apps, I found this hack in the OnDemand sample that ships with the May CTP.

/WORKAROUND: REMOVE BEFORE RELEASE
if (argv.Length == 0 || argv[0] != "RUN")
{
AppDomainSetup domaininfo = new AppDomainSetup();
domaininfo.ApplicationName = "OnDemand.deploy,version='1.0.0.0',publicKeyToken='32f4b9751433b77e',processorArchitecture='msil',language='default'";

// Create the application domain.
AppDomain newDomain = AppDomain.CreateDomain("HackDomain", null, domaininfo);
newDomain.ExecuteAssembly(System.Reflection.Assembly.GetExecutingAssembly().Location, null, new String[] { "RUN" });
}
else
{
Application.Run(new MainForm());
}

Is this at al related to a bug with ClickOnce publishing?

re: ClickOnce security and download on demand

Peter Bernhardt — Thu, 03 Jun 2004 17:53:00 GMT

As an addendum to my earlier post, here's what I get in the output window after I attempt to publish from the tool menu:

Error: The operation could not be completed. Unspecified error
========== Build: 1 succeeded, 0 failed, 1 up-to-date, 0 skipped ==========
========== Publish: 0 succeeded, 0 failed, 0 skipped ==========

Any idea what's causing that unspecified error?

ClickOnce permission escalation is poopie

Managed Space — Thu, 20 Jan 2005 11:04:00 GMT