Using MSBuild to Sign ClickOnce or Assembly Error: MSB3321

Question

I've set up my simple project in VS2008 to use a click-once installer. I've specified that the ClickOnce manifests should be signed by our comapny's pfx file. When I set this up in Visual Studio it asked for the password for the pfx file, which I gladly supplied. Everything works fine when I build and publish from within Visual Studio. It also works fine building from MSBuild on my machine.

However when I try to build it using MSBuild on our build machine, I get the following error:

ERROR MSB3321 in 
    C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft.Common.targets(1805,7)
    : Importing key file "ourCertificate.pfx" was canceled (sic).

After some searching I've found a little bit of information that says this is because I haven't supplied the password. But I can't find a way to supply the password on the build machine. I've also seen suggestions to install Visual Studio, and supply the password once inside VS, and then it will work from MSBuild after that. But I'd really like to avoid installing visual studio on the build machine.

I've tried double clicking the pfx file to import it and putting in the password when asked, but this didn't help.

This same thing happens if I check 'Sign the assembly' in VS and supply the same pfx file.

Any suggestions? Is there a manual way of storing the password on the build machine?

Answer 1

Can you import your certificate into your Trusted Publisher store on the build machine? (Internet Explorer > Tools > Options > Content > Certificates)

I don't use MSBuild to create deployments; I use Mage. However, I use our .pfx file to import our cert into my Trusted Publisher store. In order to do that I have to input the password. After that's done, when I save a manifest in Mage I no longer have to provide a password. I can simply select the cert from my store.

Answer 2

John Robbins' has a blog post about how to wrap signtool.exe in MSBUILD.

http://www.wintellect.com/CS/blogs/jrobbins/archive/2007/12/21/code-signing-it-s-cheaper-and-easier-than-you-thought.aspx

Hope this helps.