Configuring ClickOnce to best work for your deployment scenario   

SAURABH PANTPROGRAM MANAGER

MICROSOFT CORPORATION

Configuring ClickOnce to best work for your deployment

scenario   

ClickOnce Deployment Framework

Smart Client Deployment meets Web DeploymentSmart Client Deployment meets Web Deployment Run an Application by Clicking on a URLRun an Application by Clicking on a URL Update the Application by Updating on ServerUpdate the Application by Updating on Server

Isolated Low Impact Declarative InstallationIsolated Low Impact Declarative Installation

Auto UpdateAuto Update Flexible Declarative Update Options Flexible Declarative Update Options Rich Programmatic ExtensibilityRich Programmatic Extensibility

Deep Microsoft Visual Studio IntegrationDeep Microsoft Visual Studio Integration

Rich Security ModelRich Security Model CLR CAS sandboxing CLR CAS sandboxing Permission elevation prompting w/ AuthenticodePermission elevation prompting w/ Authenticode

Choosing Your Installation Technology

Web Click

Once

MSI Client

Reach Y

No Touch Deployment Y Y

Low System Impact Y Y

Install/Run Per-User Y Y

Rich / Interactive Y Y

Offline Y Y

Windows Shell Integration Y Y

Per-Machine/Shared Components Y

Extensible Install Logic Y

What to Use When

Use ClickOnce… When you are building Per User, Isolated applications

targeting the .Net runtime 2.0+

Use Windows Installer… For all other applications the Windows Installer

continues to provide the best install, management and servicing support on Windows Vista and down-level platforms

Using MSI and ClickOnce

Typical Deployment Scenario

Application Branding?

.Net 2.0 Deployment Recommendations

App Developers deliver App bits to the Enterprise

Enterprise to ‘brand’ the Application Authenticode signature Product/Publisher/SupportUrl

Publish Location needs to be known while ‘branding’ Publish Location burnt into Signed Manifest

Prevents Deployment from being hijacked Prevents loss of Data due to install Url change

.Net 2.0 Deployment Recommendations …

ISVs wanting to preserve ‘branding’ Online Applications ISV handles Signing (Web Service …) Share Authenticode Key?

Enterprises wanting to avoid re-signing (XCopy Publishing) Online Applications ISV handles Signing

Do NOT modify .application contents without updating its identity

New in Orcas

• Application Manifest can provide App Branding

New in Orcas …

Publish Location can be excluded from .application for an Installed App

Orcas Deployment Recommendations

Default recommended scenario same as .Net 2.0 App Developers deliver App bits to the Enterprise Enterprise to ‘brand’ the Application Publish Location needs to be known while ‘branding’

VS to generate the same default manifests

Orcas Deployment Recommendations …

ISVs wanting to preserve ‘branding’ App Manifest contains branding Information and a tag

specifying <Use Application Manifest for Trust/Branding> Enterprise can sign the .application with any self-sign cert

ISVs do not need to share their Authenticode Certificates! Publish Location needs to be known while signing not

branding

ISVs need to explicitly Opt Into the above behaviorThe enterprise can trump the ISVs choice by modifying the

App Manifest to use enterprise branding

Orcas Deployment Recommendations …

Enterprises wanting to avoid re-signing (XCopy Publishing, App Replication) Exclude Publish Url from the .application

Caveats Application can now potentially be hosted by Evil.com Same application cannot be installed from two different

URL Explicitly blocked by ClickOnce to prevent data loss

Also New in Orcas …

Xbrowser Support ClickOnce will work with Non IE Browsers Out of the

Box Requires the .application to contain the Publish Url OOB no support for Query Strings

Public API exposed to facilitate developing a Xbrowser plugin for ClickOnce

FireFox Demo

Resources

WindowsForms.Net Deployment Page[http://www.windowsforms.net/features/

deployment.aspx]

Saurabh's Blog[http://blogs.msdn.com/saurabh]

Orcas Oct CTP

Live from Redmond …

14-Nov [Steve Lasker] Live From Redmond: Smart Client: Offline Data Synchronization and

Caching for Smart Clients link

28-Nov [Saurabh Pant] Live From Redmond: Client Application Services in Orcas link

4-Dec [Steve Lasker] Live From Redmond: Visual Studio: Developing Local and Mobile Data

Solutions with SQL Server Everywhere link

Dec 6 [Mahesh Prakriya] Live From Redmond: IronPython: Developing agile but rich client

applications using Python link