Individual signing of clickonce files

[jackmtpt]

We would like the ability to sign individual clickonce-related files separately. E.g. explicitly signing the binaries, the .manifest and then the .application files without going via the .clickonce zip package format that has been created for this tool.

The build process for our applications of course does not produce such a file automatically, nor is it usable for deployment. That means that we have to:

• create the zip explicitly in our build pipeline
• pass it to dotnet sign, which will then unzip it again into a temporary location, sign the relevant files, and re-zip it
• then we have to unzip it again in order to actually deploy it anywhere

This is fine for small applications, but for larger clickonce packages it's quite slow and doesn't seem worth it at all.

Therefore I'm proposing to add a new type of SignatureProvider class that natively handles .deploy, .manifest and .application files and signs them in the proper order without needing to bother with a zip file.

Would a PR implementing such a feature be accepted?

[afscrome]

This sounds like it's exactly what https://github.com/dotnet/sign/issues/470#issuecomment-1349601806 is asking for

[dtivel]

@jackmtpt, we agree the .clickonce workaround should be removed. That's tracked by #470.

Beyond that, we don't fully understand your scenario to the extent that we can validate a proposal yet. For example, these files need to be signed in a particular order to ensure consistency.

Can you describe how you would like to sign (e.g.: how many Sign CLI invocations, what you will sign and in what order, etc.)? Any other context will help.

CC @clairernovotny

[jackmtpt]

Really we just want a way to sign clickonce apps without needing the zip workaround. Whether we have to call dotnet sign multiple times to sign the .manifest and .application files separately (in the right order) or whether we call it once and a new SignatureProvider class just iterates over the files that it's been given and signs .manifest files first and then .application files later we don't really mind.

I'm happy to write an initial implementation that works for what we want so we can discuss actual code if you want?