ClickOnce

ClickOnce is a Microsoft technology for deploying Windows Forms or Windows Presentation Foundation-based software, also called Smart clients. It is similar to Java Web Start for the Java Platform.

ClickOnce is only available in .NET 2.0 and later. A less advanced technique can be obtained with the Microsoft Updater Application Block.

Description

ClickOnce enables the user to install and run a Windows application by clicking a link in a web page. The core principle of ClickOnce is to bring the ease of deployment of web applications to the Windows user. In addition, ClickOnce aims to solve three other problems with conventional deployment models: the difficulty in updating a deployed application, the impact of an application to the user's computer, and the need for administrator permissions to install applications.

ClickOnce-deployed applications are considered 'low impact', in that they are installed per-user, not per-machine. No administrator privileges are required to install one of these applications. Each ClickOnce application is isolated from the other. This means one ClickOnce application is not able to 'break' another.

ClickOnce employs CAS (Code Access Security) to ensure that system functions cannot be called by a ClickOnce application from the web, ensuring the security of data and the client system in general.

Applications

The ClickOnce model supports two flavors of applications: installed applications (akin to conventional Windows applications with start menu integration) and online applications (browser hosted applications that are not installed, only run and cached). ClickOnce applications can be deployed to a computer from a Web location, a network share, or even from a file location such as a CD.

The ClickOnce deployment technology has been integrated into the Visual Studio Integrated Development Environment since version 2005 and is also natively supported by MSBuild, Microsoft's build management technology.

Manifests

A ClickOnce deployment is controlled through the use of two XML manifest files: a deployment manifest and an application manifest. The manifests are in the same XML format as the Side-by-Side Assembly implementation. The deployment manifest file describes the deployment model: the current version, update behavior, publisher identity along with digital signature. This manifest is intended to be authored by administrators who handle deployment. The application manifest — a .exe.manifest file — describes the application assemblies, dependent libraries and lists permissions required by the application. This file is intended to be authored by the application developer. In order to launch a ClickOnce application, a user clicks on its deployment manifest file.

Updates

ClickOnce applications can be self-updating; they can check for newer versions as they become available and automatically replace any updated files. For its installed application flavor, ClickOnce presents several update options. Applications can be configured to check for updates on startup or after startup. ClickOnce also exposes programmatic APIs to customize update behavior. There is also support for required or mandatory updates for managing ongoing updates and ensuring that the entire user-base can be moved up to a new version in a timely manner.

Signatures

Prior to .NET 3.5 SP1, ClickOnce applications had to be signed with an Authenticode Digital Certificate. You can create your own, but users will be prompted with security warnings that the signature cannot be verified. Certificates can be purchased from a number of Microsoft certified vendors for roughly $100-200 for a single year. After the year is over you must apply for a renewal of the certificate; however, this certificate has a new key. With a new key, the application will then not recognize the publisher and updates can no longer be sent to users. The application then has to be reinstalled with the new key. This issue will be fixed in Visual Studio 2008. Optionally, a 10 year certificate can be purchased.

There is a workaround cited here for expiration of annual certificates: http://blogs.msdn.com/danielma/archive/2007/03/19/clickonce-and-expired-certificates.aspx

Firefox extensions

Prior to .NET 3.5 SP1, ClickOnce worked only with Internet Explorer, although the FFClickOnce extension allowed Firefox to support it. Starting with .NET 3.5 SP1 and Firefox 3, a Firefox extension is installed by Microsoft when an update of the .NET framework is installed. This extension can be uninstalled by editing the Windows Registry (removal procedure) or by installing an update to the .NET Framework Assistant for Firefox from Microsoft. See also this blog post discussing ClickOnce issues with Firefox.

Microsoft offers instructions on How to manually remove the .NET Framework Assistant for Firefox as well as providing an Update to .NET Framework 3.5 SP1 for the .NET Framework Assistant 1.0 for Firefox that makes it possible to uninstall the plugin. The KB article states that the reason the 'uninstall' button is disabled in the plugin is that the plugin was installed at the machine-level rather than the user-level and mentions a forthcoming update for .NET Framework 3.5 SP1 that will install the plugin on a per-user basis, thus activating the 'uninstall' button for the plugin.

On 16 October 2009, Mozilla blocked the Microsoft .NET Framework Assistant extension and Windows Presentation Foundation plugin from being used with Firefox and removed the extension from the Mozilla Add-ons service, and then removing it from the block list two days later on the 18th of October 2009.

See also

• Microsoft .NET
• Java Web Start
• Zero Install

External links

• ClickOnce Deployment for Windows Forms Applications – ClickOnce content on MSDN
• How to manually remove the .NET Framework Assistant for Firefox – Microsoft Help & Support