ClickOnce in General

I've had many emails lately about my ClickOnce deployment using NAnt post so I thought I'd post a little bit about how ClickOnce works in general.

First, there are two files necessary to deploy a ClickOnce app: the deployment manifest and the application manifest. The deployment manifest contains version specific information about your app. This is the file that makes version 1.2 different from 1.3. You should have one deployment manifest for every version you deploy.

The application manifest, however, is really the main entry point into ClickOnce. It contains information about which version is the most recent (eg. 1.3) and redirects the client to the appropriate deployment manifest. You will have just a single application manifest for your project. It is the URL of the application manifest you should give to your users so they can open the application.

The tricky thing about ClickOnce manifests is that in addition to containing a list of files necessary to run an application they contain a hash of each file. This hash is like a digital signature and used to prevent ClickOnce from delivering malicious files. So, any time you release a new version (or change your ClickOnce payload) you must do the following (using Mage):

1. Create a new deployment manifest (for the new version)
2. Sign the deployment manifest (to regenerate the hash of each file)
3. Update your application mainfest (so it points to the new deployment manifest from 1)
4. Sign your application manifest

Once that is done you're pretty much good to go :-)

Also, for further reading my colleague Jonas Avellana has a great post on setting up ClickOnce to deploy to multiple environments.