I have a ClickOnce app that I am updated to be deployed using a modern deployment Jenkins Pipeline with MSBuild. Part of this effort is signing the .manifest and .application files.
Previously we used <SignFile>
with MSBuild to sign these, using certificates that were installed in the user's personal store on the build machine. It worked with:
<SignFile SigningTarget="MyApp.exe.manifest"
CertificateThumbprint="1a 9f ..."
TimestampUrl="http://timestamp.verisign.com/scripts/timstamp.dll" />
<SignFile SigningTarget="MyApp.application"
CertificateThumbprint="1a 9f ..."
TimestampUrl="http://timestamp.verisign.com/scripts/timstamp.dll" />
However, in the 21st century we prefer to have everything we need to build either in version control or available in a secret store via an API, so that we no longer depend on the build server to be in a certain state.
So how can we use SignFile to sign a ClickOnce manifest and application without the certificate needing to be installed? Or am I not thinking about this right?
If there is a better way than using <SignFile>
, let me know--as far as I can tell, SignTool.exe and Mage.exe both require the certificate to be installed as well.