1. 1 Introducing ClickOnce: The New Application Deployment Model for Windows Forms and “Avalon” Jamie Cool (jamiec@microsoft.com) Program Manager Microsoft Corporation Jamie Cool (jamiec@microsoft.com) Program Manager Microsoft Corporation Session Code: CLI370 Speaker: Please: 1. fill in your session code, and 2. copy the appropriate “Virtual Track” icon(s) onto the title slide.

2. 2 Agenda Client Deployment Re-visited ClickOnce Walkthrough & Demos Reliable & easy web based installs Deployment & update options Security model Questions Client Deployment Re-visited ClickOnce Walkthrough & Demos Reliable & easy web based installs Deployment & update options Security model Questions

3. 3 Tools Client Application Model AvalonWindows Forms Web & Service Application Model ASP.NET / Indigo Win FS Compact Framework Yukon Mobile PC Optimized System.Help System.Drawing System.NaturalLanguageServices Data Systems Application Model Presentation Data Mobile PC & Devices Application Model Communication Command Line NT Service DataSet Mapping ObjectSpaces ObjectSpace Query Schema Item Relationship Media Audio Video Images System.Messaging System. Discovery System.DirectoryServices System.Remoting System.Runtime.Remoting Active Directory Uddi System.Web.Services Web.Service Description Discovery Protocols System.MessageBus Transport Port Channel Service Queue PubSub Router System.Timers System.Globalization System.Serialization System.Threading System.Text System.Design Base & Application Services Fundamentals System.ComponentModel System.CodeDom System.Reflection System.EnterpriseServices System.Transactions Security System.Windows. TrustManagement System.Web. Security System.Message Bus.Security Authorization AccessControl Credentials Cryptography System.Web.Configuration System.MessageBus.Configuration System.Configuration System.Resources System.Management System.Deployment System.Diagnostics ConfigurationDeployment/Management System.Windows System.Windows.Forms System.Console System.ServiceProcess System.Windows.Forms System.Web System.Storage System.Data.SqlServer Animation Controls Control Design Panel Controls Dialogs SideBar Notification System.Windows Documents Text Element Shapes Shape Ink UI Element Explorer Media System.Windows.Forms Forms Control Printing Design System.Web.UI Page Control HtmlControls MobileControls WebControls Adaptors Design Ports InteropServices System.Runtime System.IO System.Collections Generic System.Search Annotations Monitoring Logging Relevance System.Data SqlClient SqlTypes SqlXML OdbcClient OleDbClient OracleClient Core Contact Location Message Document Event System.Storage System.Web Personalization Caching SessionState System.Xml Schema Serialization Xpath Query Permissions Policy Principal Token System.Security System.Collaboration RealTimeEndpoint TransientDataSession SignalingSession Media Activities HttpWebRequest FtpWebListener SslClientStream WebClient System.Net NetworkInformation Sockets Cache System.Web Administration Management Navigation Peer Group Policy Serialization CompilerServices Recognition System.Speech Synthesis

4. 4 Deployment Problems Installing client apps is fragile Will the install of app1 break app2? Traditional DLL hell problem Installing client apps is hard & expensive Must touch every client Both for 1 st time install & subsequent updates Installing client apps is fragile Will the install of app1 break app2? Traditional DLL hell problem Installing client apps is hard & expensive Must touch every client Both for 1 st time install & subsequent updates

5. 5 ClickOnce Vision Bring the ease & reliability of web application deployment to client applications.

6. 6 ClickOnce User Experience Running a client app from the web

7. 7 V1 of the.NET Framework Addressed #1 app safety issue, DLL Hell Application Isolation Controlled versioning of shared components Did not address application install safety Began to address ease of deployment Run from URL/UNC exes, browser controls… ClickOnce builds upon these technologies Addressed #1 app safety issue, DLL Hell Application Isolation Controlled versioning of shared components Did not address application install safety Began to address ease of deployment Run from URL/UNC exes, browser controls… ClickOnce builds upon these technologies

8. 8 Development Experience Integrated VS Support Integrated to core project system Setup is not a post-development operation Publish Wizard Copies application to web server FTP, UNC, FrontPage Server Extensions Integrated VS Support Integrated to core project system Setup is not a post-development operation Publish Wizard Copies application to web server FTP, UNC, FrontPage Server Extensions

9. 9 ClickOnce End-To-End Building, deploying & updating a client application

10. 10 The Best of the Client & Web WebClick Once MSI Client ReachY No Touch DeploymentYY Low System ImpactYY Install/Run Per-UserYY Rich / InteractiveYY OfflineYY Windows Shell IntegrationYY Per-Machine/Shared ComponentsY Unrestricted InstallY

11. 11 Install Goals Reduce install fragility Allow what’s low impact Ex. App file copy, start menu integration, etc… Can always undo what was installed Disallow what’s not low impact Apps never run with admin rights (LUA) Driver registration, COM objects, etc.. Custom actions; large source of install uncertainty Expand the definition of “low impact” Requires OS Changes. Starts with Longhorn Reduce install fragility Allow what’s low impact Ex. App file copy, start menu integration, etc… Can always undo what was installed Disallow what’s not low impact Apps never run with admin rights (LUA) Driver registration, COM objects, etc.. Custom actions; large source of install uncertainty Expand the definition of “low impact” Requires OS Changes. Starts with Longhorn

12. 12 Install-Time Support ClickOnce “Whidbey” ClickOnce “Longhorn” MSI Low ImpactYes No* Application FilesYes Start Menu / ARPYes RegFree COM (XP)Yes File AssociationsYes Shell ExtensionsYes Managed ConfigYes Shared ComponentYes Custom ActionsYes *MSI is flexible, what it does is totally up to the MSI developer.

13. 13 VS Bootstrapper Bridging the Gap to the Future Lay down application pre-reqs Ex. (.NET FX, Crystal, DirectX, MDAC, etc…) Must be an admin to run Bootstrapper Extensible Install ClickOnce application after pre-reqs Use ClickOnce for auto-updates No auto-updates of pre-reqs components.NET FX V1.1 Bootstrapper available today All ClickOnce apps require the.NET FX FX is part of “Longhorn” Lay down application pre-reqs Ex. (.NET FX, Crystal, DirectX, MDAC, etc…) Must be an admin to run Bootstrapper Extensible Install ClickOnce application after pre-reqs Use ClickOnce for auto-updates No auto-updates of pre-reqs components.NET FX V1.1 Bootstrapper available today All ClickOnce apps require the.NET FX FX is part of “Longhorn”

14. 14 Declarative Install Application Manifest Describes the application Ex.. What assemblies constitute the app Authored by the developer Deployment Manifest Describes the application deployment Ex.. What version clients should run Authored by the administrator Application Manifest Describes the application Ex.. What assemblies constitute the app Authored by the developer Deployment Manifest Describes the application deployment Ex.. What version clients should run Authored by the administrator

15. 15 Run & Update from the Web Deployment Manifest 1.0 Deployment Manifest 1.0 Application Manifest 1.0 Application Manifest 1.0 Web Page w/ Link to Manifest Application Manifest 1.1 Application Manifest 1.1 Assembly List…  1.1 Assembly List…

16. 16 Deployment Options ‘Installed’ Applications From Web, UNC or CD Start Menu, Add/Remove Programs Varied update options ‘Launched' Applications App launches but doesn’t “install” No Start Menu, Add/Remove Programs Always update on launch ‘Installed’ Applications From Web, UNC or CD Start Menu, Add/Remove Programs Varied update options ‘Launched' Applications App launches but doesn’t “install” No Start Menu, Add/Remove Programs Always update on launch

17. 17 Update Options On App Startup If found, ask user to update app After App Startup If found, ask user to update on next run Programmatic Integrate update experience into app Required Update can specify minimum version required Background Updates Updates drizzle in silently – like Windows Updates “Longhorn” only On App Startup If found, ask user to update app After App Startup If found, ask user to update on next run Programmatic Integrate update experience into app Required Update can specify minimum version required Background Updates Updates drizzle in silently – like Windows Updates “Longhorn” only

18. 18 Secure Updates Only the original deployer can update No auto-deployment of viruses Manifests are signed XMLDSIG Deployer key needed to publish updates Only the original deployer can update No auto-deployment of viruses Manifests are signed XMLDSIG Deployer key needed to publish updates

19. 19 “Longhorn Web” Apps Integrated with Browser Install UI built into browser Best possible user experience Leverages Avalon app/navigation model No shell presence (ex. Start Menu shortcut) Runs in semi-trust Progressive Install App automatically installs as it’s used File level install Integrated with Browser Install UI built into browser Best possible user experience Leverages Avalon app/navigation model No shell presence (ex. Start Menu shortcut) Runs in semi-trust Progressive Install App automatically installs as it’s used File level install

20. 20 “Longorn Web” Apps Deploying & running an app in the browser

21. 21 Security: The Sandbox (SEE) Apps run in secure sandbox by default Similar to IE javascript Ensures applications are safe to run Increased sandbox size “Longhorn” > “Whidbey” >.NET V1.1 VS helps author for the sandbox Debug in Zone PermissionCalc Security Exception helper Apps run in secure sandbox by default Similar to IE javascript Ensures applications are safe to run Increased sandbox size “Longhorn” > “Whidbey” >.NET V1.1 VS helps author for the sandbox Debug in Zone PermissionCalc Security Exception helper

22. 22 Security: Sandbox Restrictions Some apps need more permission Un-managed code access Export to Excel or any MS Office integration Un-restricted file access Un-restricted network access Some apps need more permission Un-managed code access Export to Excel or any MS Office integration Un-restricted file access Un-restricted network access

23. 23 Security: Policy Deployment Application level policy “Trust this app” “App” defined by it’s app manifest Baked into core CLR security Trust Licenses License issued by admin, deployed with app License indicates admin says app is trusted Requires only one-time (ever) client touch To configure trusted license issuer Application level policy “Trust this app” “App” defined by it’s app manifest Baked into core CLR security Trust Licenses License issued by admin, deployed with app License indicates admin says app is trusted Requires only one-time (ever) client touch To configure trusted license issuer

24. 24 User Consent Admins should make trust decisions, but… Not always possible Home users are their own admin Users make trust decisions all the time Putting a CD in their computer Installing software Submitting a Credit card to a web page Admins should make trust decisions, but… Not always possible Home users are their own admin Users make trust decisions all the time Putting a CD in their computer Installing software Submitting a Credit card to a web page

25. 25 User Consent Design App request permissions needed Requests specified in app manifest VS helps identify needed permissions Prompt is simple & binary Happens at install / 1 st launch Combined Install & Trust Prompt User prompted if: App needs permissions above the sandbox Admin has configured to allow prompting App request permissions needed Requests specified in app manifest VS helps identify needed permissions Prompt is simple & binary Happens at install / 1 st launch Combined Install & Trust Prompt User prompted if: App needs permissions above the sandbox Admin has configured to allow prompting

26. 26 ClickOnce Security Declarative security & user consent

27. 27 ClickOnce APIs Update Support Control when & how the app updates CheckForUpdate(), Update(), etc.. On-Demand Support Download files as needed Download only required files at 1 st install Use API to trigger download of files as needed Replaces Assembly.LoadFrom() Update Support Control when & how the app updates CheckForUpdate(), Update(), etc.. On-Demand Support Download files as needed Download only required files at 1 st install Use API to trigger download of files as needed Replaces Assembly.LoadFrom()

28. 28 Other Sessions… SessionDate/Time CLI400: Advanced Topics in Web Based Application Deployment for Windows Forms and "Avalon" Wens, 2:00 PM TLS344: Visual Studio "Whidbey": Deploying Applications Using ClickOnce Wens, 10:00 AM CLI303: Avalon: Creating Windows “Longhorn” User Experiences Wens, 3:30 PM CLI312: Windows “Longhorn”: Enhancements for a Trustworthy Application Experience Wens, 5:00 PM

29. 29 Call to Action Use ClickOnce! Included in “Whidbey” & “Longhorn” Alphas Give us your Feedback! What do you like? What’s missing? What did you have problems with? Use ClickOnce! Included in “Whidbey” & “Longhorn” Alphas Give us your Feedback! What do you like? What’s missing? What did you have problems with?

30. 30 © 2003-2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.