Deployment Exception ClickOnce & Sign

[EgemenCiftci]

Hello, We upgraded our WPFLocalizationExtension from 3.3.1 to 3.6.1. Created a ClickOnce installer package. When installing it we are getting this exception. We are also getting this exception from XAMLMarkupExtensions. We had no issues about this with v3.3.1.

ERROR DETAILS Following errors were detected during this operation.

• [17.06.2020 23:57:37] System.Deployment.Application.InvalidDeploymentException (SignatureValidation)
  • Strong name signature not valid for this assembly WPFLocalizeExtension.dll.
  • Source: System.Deployment
  • Stack trace: at System.Deployment.Application.ComponentVerifier.VerifyStrongNameAssembly(String filePath, AssemblyManifest assemblyManifest) at System.Deployment.Application.ComponentVerifier.VerifyComponents() at System.Deployment.Application.DownloadManager.DownloadDependencies(SubscriptionState subState, AssemblyManifest deployManifest, AssemblyManifest appManifest, Uri sourceUriBase, String targetDirectory, String group, IDownloadNotification notification, DownloadOptions options) at System.Deployment.Application.ApplicationActivator.DownloadApplication(SubscriptionState subState, ActivationDescription actDesc, Int64 transactionId, TempDirectory& downloadTemp) at System.Deployment.Application.ApplicationActivator.InstallApplication(SubscriptionState& subState, ActivationDescription actDesc) at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(Uri activationUri, Boolean isShortcut, String textualSubId, String deploymentProviderUrlFromExtension, BrowserSettings browserSettings, String& errorPageUrl, Uri& deploymentUri) at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivationWithRetry(Uri activationUri, Boolean isShortcut, String textualSubId, String deploymentProviderUrlFromExtension, BrowserSettings browserSettings, String& errorPageUrl) --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivationWithRetry(Uri activationUri, Boolean isShortcut, String textualSubId, String deploymentProviderUrlFromExtension, BrowserSettings browserSettings, String& errorPageUrl) at System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(Object state)

COMPONENT STORE TRANSACTION DETAILS No transaction information is available.

[konne]

Hi,

please can you check if the following approach will help you:

https://github.com/XAMLMarkupExtensions/WPFLocalizationExtension/issues/225#issuecomment-615198865

We had already a very long code signing discussion and till now there is no 100% solution and the current design is great but have some issues in with click once.

bye Konrad

[benjaminrupp]

Hi,

Is it possible to have a second nuget-version with a signed project? I just saw there is a nuget paket called "WpfLocalizeExtension.Signed". But this is an old version. We did not have sucess using the strong name signer with out click-once project. So the solution of #225 does not helf us.

Best regards

Benjamin

[konne]

Hi Benjamin,

sorry the "WpfLocalizeExtension.Signed" is from a other person that didn't marked it with a forkname and I even if I would add this signed version, this is not possible because I have no access to this nuget package. Can you provide a small sample app, that shows that issue, I will than try to find a good solution for your issue.

bye Konrad

[konne]

@benjaminrupp

[benjaminrupp]

@konne:

We get the following exception with a strong signed dll:

Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.IO.FileLoadException bei System.Reflection.RuntimeAssembly._nLoad(System.Reflection.AssemblyName, System.String, System.Security.Policy.Evidence, System.Reflection.RuntimeAssembly, System.Threading.StackCrawlMark ByRef, IntPtr, Boolean, Boolean, Boolean) bei System.Reflection.RuntimeAssembly.InternalLoadAssemblyName(System.Reflection.AssemblyName, System.Security.Policy.Evidence, System.Reflection.RuntimeAssembly, System.Threading.StackCrawlMark ByRef, IntPtr, Boolean, Boolean, Boolean) bei System.Reflection.Assembly.Load(System.Reflection.AssemblyName) bei System.Windows.Baml2006.Baml2006SchemaContext.ResolveAssembly(BamlAssembly) bei System.Windows.Baml2006.Baml2006SchemaContext.ResolveBamlTypeToType(BamlType) bei System.Windows.Baml2006.Baml2006SchemaContext.ResolveBamlType(BamlType, Int16) bei System.Windows.Baml2006.Baml2006SchemaContext.GetXamlType(Int16) bei System.Windows.Baml2006.Baml2006Reader.Process_ElementStart() bei System.Windows.Baml2006.Baml2006Reader.Process_OneBamlRecord() bei System.Windows.Baml2006.Baml2006Reader.Process_BamlRecords() bei System.Windows.Baml2006.Baml2006Reader.Read() bei System.Windows.Markup.WpfXamlLoader.TransformNodes(System.Xaml.XamlReader, System.Xaml.XamlObjectWriter, Boolean, Boolean, Boolean, System.Xaml.IXamlLineInfo, System.Xaml.IXamlLineInfoConsumer, MS.Internal.Xaml.Context.XamlContextStack`1, System.Windows.Markup.IStyleConnector) bei System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)

Ausnahmeinformationen: System.Windows.Markup.XamlParseException bei System.Windows.Markup.XamlReader.RewrapException(System.Exception, System.Xaml.IXamlLineInfo, System.Uri) bei System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri) bei System.Windows.Markup.WpfXamlLoader.LoadBaml(System.Xaml.XamlReader, Boolean, System.Object, System.Xaml.Permissions.XamlAccessLevel, System.Uri) bei System.Windows.Markup.XamlReader.LoadBaml(System.IO.Stream, System.Windows.Markup.ParserContext, System.Object, Boolean)

It looks like more people get this exception and the project is dead: https://github.com/brutaldev/StrongNameSigner/issues/31

[konne]

Hi benjamin,

please can you check the following approach: https://stackoverflow.com/a/4517482 That you sign only the manifest and not the full all?

Thanks for pointing on the StrongNameSigner XAML/BAML issue.

bye Konrad

[benjaminrupp]

Hi Konrad,

we are only signing the manifest. Nothing more.

Benjamin

[aknot13]

Hi,

This is a serious problem. I spent days replacings all strings using this great extension only to find out that I can't deploy it using clickonce. I had to downgrade to 3.3.1 but now I can't use some of the latest features. I'm using .net framework 4.7.2.

It turns out that your strong named assembly in the package is invalid signed. You probably made a mistake.

You can easily verify this by using this command:

sn -vf WPFLocalizeExtension.dll

It gives "Failed to verify assembly -- Strong name validation failed.".

I use a lot of other strong named assemblies as nuget packages and I never had this problem. The 'sn' verification succeeds.

Can you please fix this issue and release a new version please? It's not a code issue I think. Thanks.

[maggima]

Experiencing the same problem after upgrading to 3.8. That's a serious issue breaking ClickOnce deployments...

[konne]

@maggima @aknot13 @benjaminrupp @EgemenCiftci @Karnah Starting from the next release the release is fullsigned. For everybody who want to have an unsigned version this is now also available from nuget.

please check the new 3.8.1-preview1 release. This should solve this issue Can you please give feedback

[UeliHilfiker]

I has upgraded from 3.3.1 to 3.8.1-preview1: I could deploy and update/install the application sucessful. 👍

[konne]

@UeliHilfiker thanks for the feedback. there is already a 3.9 release so that you don't have to use a preRelease