Default publisher name may result in a failed ClickOnce installation
- Dominant language
- C#
- Stars
- 581
- Forks
- 116
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 8
Description
## Describe the bug
When signing a ClickOnce package without `--publisher-name`, the publisher information from the certificate may be too long. No messages are logged by `sign` indicating something may be amiss. `mage` verified the manifest, but when attempting to install in Windows Sandbox, the following exception is reported:
```
ERROR SUMMARY
Below is a summary of the errors, details of these errors are listed later in the log.
* Activation of C:\Users\WDAGUtilityAccount\Desktop\HCS.application resulted in exception. Following failure messages were detected:
+ The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters, and the directory name must be less than 248 characters.
```
_There were no relevant details later in the log._
## Repro steps
https://github.com/MH-ZShearer/SignedClickOnce is a barebones .NET 6 WinForms application that has a simple ClickOnce publish profile configured.
Our certificate's `Subject`, which got used as the `Publisher` somehow, looks like this:
```
E=software@mhforce.com, CN=Morehouse Instrument Company, O=Morehouse Instrument Company, L=York, S=Pennsylvania, C=US, OID.1.3.6.1.4.1.311.60.2.1.2=Pennsylvania, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=238776, OID.2.5.4.15=Private Organization
```
### ClickOnce Releases
- [Unsigned](https://github.com/MH-ZShearer/SignedClickOnce/releases/download/releases%2Fv1.0.0.0/Unsigned.zip)
- [Signed, Unspecified Publisher](https://github.com/MH-ZShearer/SignedClickOnce/releases/download/releases%2Fv1.0.0.0/SignedWithoutPublisher.zip)
- `sign code azure-key-vault ".\SignedClickOnce\bin\publish\SignedClickOnce.application" -kvu -kvc `
- [Signed, Specified Publisher](https://github.com/MH-ZShearer/SignedClickOnce/releases/download/releases%2Fv1.0.0.0/SignedWithPublisher.zip)
- `sign code azure-key-vault ".\SignedClickOnce\bin\publish\SignedClickOnce.application" -kvu -kvc -pn "Morehouse Instrument Company"`
## Expected behavior
A warning, or even an informational log, message stating that a `Publisher` longer than maybe 50 characters may cause issues due to ClickOnce limitations. According to the below message, this may also be relevant for the product name as well.
## Actual behavior
No notice that something could have been wrong, even with trace logging.
## Additional context
The following exception came from the above **Repro steps** using our certificate. This is what ultimately led me to uncover the issue. I'm still unsure why I received different errors, or why this shows that the deployment manifest is not semantically valid.
```
ERROR SUMMARY
Below is a summary of the errors, details of these errors are listed later in the log.
* Activation of C:\Users\WDAGUtilityAccount\Desktop\SignedClickOnce.application resulted in exception. Following failure messages were detected:
+ Exception reading manifest from file:///C:/Users/WDAGUtilityAccount/Desktop/SignedClickOnce.application: the manifest may not be valid or the file could not be opened.
+ Deployment manifest is not semantically valid.
+ Publisher and/or Product name in the deployment manifest must be less than 260 characters.
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.