Click Once deployment - cannot continue. the application is improperly formatted

[BillE]

I am using clickonce to publish a windows forms application developed in
VB.net VS2008.

I am getting the above error during installation. The .NET Framework (3.5)
is installed during the application installation.

The application is not signed. - I noticed in the error details the mention
that the "manifest xml signature is not valid". I hope I am not required to
digitally sign the application - I don't want to have to worry about the
application suddenly failing in one year when the digital certificate
expires.

I am interested in knowing how to solve this problem.

Thanks
Bill

 

[Patrice]

3.5 SP1 of course, not 3.6 SP1...

 

[BillE]

Thanks, I didn't know that 3.5 deployment requires a signature.

I can't use 3.5 sp1 because I am working in an isolated network and sp1 has
the Homesite Only 'feature':

'we shipped the .NET Frameworks 3.5 SP1 package as Homesite Only, i.e. only
supports "Install Prerequisites from Component Vendor's Website". We did
this to keep the size of VS 2008 SP1 from being too large.' (David Guyer,
MSFT)

I don't know what a timestamp server is, I'll look into it, but I guess my
best course of action will be to abandon ClickOnce.

merci encore
Bill

 

[Patrice]

As you wish else you have just to specify a server such as :
http://timestamp.verisign.com/scripts/timstamp.dll

in the appropriate field dialog (the signing tab in project properties if I
remember) and you are done...

 

[BillE]

Since my deployment is confined to an isolated network i guess the
application would not be able to access a timestamp server.

 

[Patrice]

It happens when you sign the application at build time, not once deployed so
it depends on your development box.

Anyway, it should be easily updatable by using xcopy as this is on
controlled machines so as you said the first step is perhaps to start by
finding out if ClickOnce is usefull or not in your case...

 

[BillE]

I like ClickOnce because it automatically updates the version.

Do you normally digitally sign the ClickOnce manifest and the Assembly for
desktop applications?

Do I just have to sign the manifest to be able to publish it using .NET
Framework 3.5 (Not SP1)?

Will the user have a problem when the certificate for the manifest expires?
Or is it just a problem when the certificate for the assembly expires?

Sorry for bombarding you with so many questions - I am having a hard time
getting a handle on this.

Thanks!
bill

 

[BillE]

Thanks for your help, I am having a lot of trouble getting a grip on the
entire digital signing process, although I have read a lot. I think I have
to experiment with it more, I guess, but I appreciate your input. I really
want to use ClickOnce, though, so applications will update automatically.
Thanks
Bill

 

[Patrice]

You are welcome.

http://msdn.microsoft.com/en-us/library/ms172240(VS.80).aspx could perhaps
help if you have not already checked this one. In particular it has also a
"How Time-Stamping Can Prevent Unintended Expiration" section....