How to sign ClickOnce application manifest file with Trusted Signing from Microsoft?

Question

I have developed a C# app in VisualStudio and deployed it via ClickOnce. I am now trying to sign all files, including the .application manifest file, with Trusted Signing from Microsoft. However, the publisher is still displayed as "Unknown Publisher" despite signing all exe and dll files. I am using a PowerShell script to apply the Trusted Signing to my files. Can someone guide me on how to properly sign the .application manifest file using Trusted Signing? Any help or recommendations would be highly appreciated!

I am also fully willing to transition to creating a .msi installer if that would apply all the signing properly, but I'm hoping I can make ClickOnce work as it is a far more convenient deployment process.

Answer 1

Hi @Kieran Clark ,

Thanks for reaching out.

Unfortunately, as of now trusted signing for clickonce application and manifest files is not supported.

To sign these (on the command line) you have to use mage.exe, see https://learn.microsoft.com/dotnet/framework/tools/mage-exe-manifest-generation-and-editing-tool )

I would suggest you post this idea at the Azure Feedback Portal, which is monitored by the product team for feature enhancements.

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Answer 2

@Kieran Clark Trusted Signing only supports file types supported by SignTool: https://learn.microsoft.com/en-us/azure/trusted-signing/faq#what-types-of-files-can-be-signed-with-trusted-signing

So, we don't yet support ClickOnce yet, however, we do support .msi.

Following up on your question in the comment, Trusted Signing certs and EKU are default trusted on supported Windows OS versions. As long as the file types are the ones supported by SignTool.