SAURABH PANT PROGRAM MANAGER MICROSOFT CORPORATION Configuring ClickOnce to best work for your deployment scenario

ClickOnce Deployment Framework Smart Client Deployment meets Web Deployment Smart Client Deployment meets Web Deployment  Run an Application by Clicking on a URL  Update the Application by Updating on Server Isolated Low Impact Declarative Installation Isolated Low Impact Declarative Installation Auto Update Auto Update  Flexible Declarative Update Options  Rich Programmatic Extensibility Deep Microsoft Visual Studio Integration Deep Microsoft Visual Studio Integration Rich Security Model Rich Security Model  CLR CAS sandboxing  Permission elevation prompting w/ Authenticode

Choosing Your Installation Technology WebClick Once MSI Client ReachY No Touch DeploymentYY Low System ImpactYY Install/Run Per-UserYY Rich / InteractiveYY OfflineYY Windows Shell IntegrationYY Per-Machine/Shared ComponentsY Extensible Install LogicY

What to Use When Use ClickOnce…  When you are building Per User, Isolated applications targeting the.Net runtime 2.0+ Use Windows Installer…  For all other applications the Windows Installer continues to provide the best install, management and servicing support on Windows Vista and down-level platforms

Using MSI and ClickOnce Install the application using ClickOnce, the supporting impactful/shared framework using MSI Application = Machine Impactful + Per- User = Pre-Requisites + Application Code = Infrequent Updates + Frequent Updates = MSI + ClickOnce Recommendation remains consistent in Orcas

Typical Deployment Scenario

Application Branding?

.Net 2.0 Deployment Recommendations App Developers deliver App bits to the Enterprise Enterprise to ‘brand’ the Application  Authenticode signature  Product/Publisher/SupportUrl Publish Location needs to be known while ‘branding’  Publish Location burnt into Signed Manifest  Prevents Deployment from being hijacked  Prevents loss of Data due to install Url change

.Net 2.0 Deployment Recommendations … ISVs wanting to preserve ‘branding’  Online Applications  ISV handles Signing (Web Service …)  Share Authenticode Key? Enterprises wanting to avoid re-signing (XCopy Publishing)  Online Applications  ISV handles Signing Do NOT modify.application contents without updating its identity

New in Orcas Application Manifest can provide App Branding

New in Orcas … Publish Location can be excluded from.application for an Installed App

Orcas Deployment Recommendations Default recommended scenario same as.Net 2.0  App Developers deliver App bits to the Enterprise  Enterprise to ‘brand’ the Application  Publish Location needs to be known while ‘branding’ VS to generate the same default manifests

Orcas Deployment Recommendations … ISVs wanting to preserve ‘branding’  App Manifest contains branding Information and a tag specifying  Enterprise can sign the.application with any self-sign cert  ISVs do not need to share their Authenticode Certificates!  Publish Location needs to be known while signing not branding ISVs need to explicitly Opt Into the above behavior The enterprise can trump the ISVs choice by modifying the App Manifest to use enterprise branding

Orcas Deployment Recommendations … Enterprises wanting to avoid re-signing (XCopy Publishing, App Replication)  Exclude Publish Url from the.application  Caveats  Application can now potentially be hosted by Evil.com  Same application cannot be installed from two different URL Explicitly blocked by ClickOnce to prevent data loss

Also New in Orcas … Xbrowser Support  ClickOnce will work with Non IE Browsers Out of the Box  Requires the.application to contain the Publish Url  OOB no support for Query Strings  Public API exposed to facilitate developing a Xbrowser plugin for ClickOnce FireFox Demo

Resources WindowsForms.Net Deployment Page [ Saurabh's Blog [ Orcas Oct CTP

Live from Redmond … 14-Nov [Steve Lasker] Live From Redmond: Smart Client: Offline Data Synchronization and Caching for Smart Clients link 28-Nov [Saurabh Pant] Live From Redmond: Client Application Services in Orcas link 4-Dec [Steve Lasker] Live From Redmond: Visual Studio: Developing Local and Mobile Data Solutions with SQL Server Everywhere link Dec 6 [Mahesh Prakriya] Live From Redmond: IronPython: Developing agile but rich client applications using Python link