How to not sign a ClickOnce Manifest

Question

I have an office 07 (specifically Outlook 07) add in created in VS 08.

When I uncheck the "Sign the ClickOnce manifests" option, and then publish, it rechecks that option automatically.

I have a regular winforms project in the same solution that allows me to publish with this unchecked.

Any idea as to why it isn't allowing me to uncheck the sign option?

Thanks!

Answer 1

You are not required to sign EXEs, but you need to sign DLLs for deployment. Your Office add in is in the form of a DLL, so it must be signed. Your WinForms project is linked into an EXE, hence it does not need to be signed.

See the relevant MSDN page:

http://msdn.microsoft.com/en-us/library/aa730868(VS.80).aspx#rsvssign_topic3

Answer 2

Hey, I seem to be encountering exact same issue. And yes the office dll needs to be signed, and that is where the .PFX file added on same "Signing" tab of properties interface come handy. I was able to work it like this in earlier versions of VS. "Sign the Assembly" does the code signing for me. But now with VS 2010, the "Sign the clickonce manifests" option gets Checked ALWAYS .. don't know why .. its irritating since I'm using MSI installer to install my add-in.

Answer 3

While you don't have to sign the manifest any more with WinForms/WPF/Console applications, VSTO solutions still require that the manifests be signed when using ClickOnce deployment. Most VSTO scenarios are in the enterprise where best practices require signing of applications. Also since VSTO solutions always run full trust there is a higher risk associated with making signing optional. This is completely separate from signing a dll; you don't need to sign the assembly with a C/O-deployed VSTO app, you have to sign the manifests; they handle the hashing and verification of the files at install time.