CODEWITHSUNDEEP
visual-studio-2008deploymentclickonce
Philip Canarsky
Philip Canarsky

Reputation: 181

How to not sign a ClickOnce manifest

I have an Office 2007 (specifically Outlook 2007) add in created in Visual Studio 2008.

When I uncheck the "Sign the ClickOnce manifests" option, and then publish, it rechecks that option automatically.

I have a regular Windows Forms project in the same solution that allows me to publish with this unchecked.

Why isn't it allowing me to uncheck the sign option?

Upvotes: 10

Views: 10784

Answers (2)

Tamas Czinege
Tamas Czinege

Reputation: 121314

You are not required to sign EXE files, but you need to sign DLL files for deployment. Your Office add-in is in the form of a DLL file, so it must be signed. Your Windows Forms project is linked into an EXE file, hence it does not need to be signed.

See the relevant MSDN page, ClickOnce Manifest Signing and Strong-Name Assembly Signing Using Visual Studio Project Designer's Signing Page, sub section Signing Assemblies.

Upvotes: 13

RobinDotNet
RobinDotNet

Reputation: 11877

While you don't have to sign the manifest any more with Windows Forms, WPF and console applications, VSTO solutions still require that the manifests be signed when using ClickOnce deployment.

Most VSTO scenarios are in the enterprise where best practices require signing of applications. Also since VSTO solutions always run full trust there is a higher risk associated with making signing optional. This is completely separate from signing a DLL file; you don't need to sign the assembly with a ClickOnce-deployed VSTO application, you have to sign the manifests; they handle the hashing and verification of the files at install time.

Upvotes: 0

Related Questions