Add safe ClickOnce publish-layout staging - #1058
Open
dtivel wants to merge 2 commits into
Open
Conversation
10 tasks
There was a problem hiding this comment.
Pull request overview
Adds dormant, contained ClickOnce file-graph staging for the future version 2 signing pipeline.
Changes:
- Adds deterministic staging, collision preflight, reference rebinding, and rollback.
- Supports default, no-dependency-signing, and no-update modes.
- Adds localized errors and extensive staging tests.
Show a summary per file
| File | Description |
|---|---|
src/Sign.Core/Tools/ClickOnce/ClickOnceFileGraphStager.cs |
Implements staging and collision validation. |
src/Sign.Core/Tools/ClickOnce/ClickOnceStagingResult.cs |
Manages staged state and rollback. |
src/Sign.Core/Tools/ClickOnce/ClickOnceStagedFile.cs |
Models a staged file. |
src/Sign.Core/Tools/ClickOnce/ClickOnceSigningMode.cs |
Defines staging modes. |
src/Sign.Core/Tools/ClickOnce/ClickOnceFileGraphStagingException.cs |
Adds staging-specific errors. |
src/Sign.Core/Resources.resx |
Adds staging error resources. |
src/Sign.Core/Resources.Designer.cs |
Exposes generated resource properties. |
src/Sign.Core/xlf/Resources.cs.xlf |
Adds Czech localization entries. |
src/Sign.Core/xlf/Resources.de.xlf |
Adds German localization entries. |
src/Sign.Core/xlf/Resources.es.xlf |
Adds Spanish localization entries. |
src/Sign.Core/xlf/Resources.fr.xlf |
Adds French localization entries. |
src/Sign.Core/xlf/Resources.it.xlf |
Adds Italian localization entries. |
src/Sign.Core/xlf/Resources.ja.xlf |
Adds Japanese localization entries. |
src/Sign.Core/xlf/Resources.ko.xlf |
Adds Korean localization entries. |
src/Sign.Core/xlf/Resources.pl.xlf |
Adds Polish localization entries. |
src/Sign.Core/xlf/Resources.pt-BR.xlf |
Adds Brazilian Portuguese entries. |
src/Sign.Core/xlf/Resources.ru.xlf |
Adds Russian localization entries. |
src/Sign.Core/xlf/Resources.tr.xlf |
Adds Turkish localization entries. |
src/Sign.Core/xlf/Resources.zh-Hans.xlf |
Adds Simplified Chinese entries. |
src/Sign.Core/xlf/Resources.zh-Hant.xlf |
Adds Traditional Chinese entries. |
test/Sign.Core.Test/Tools/ClickOnce/ClickOnceFileGraphStagerTests.cs |
Covers staging, collisions, and recovery. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Files not reviewed (1)
- src/Sign.Core/Resources.Designer.cs: Generated file
- Files reviewed: 20/21 changed files
- Comments generated: 0
- Review effort level: Balanced
dtivel
force-pushed
the
dtivel/clickonce-safe-staging
branch
from
September 6, 2026 13:57
bddf243 to
b947483
Compare
dtivel
changed the title
Stage resolved ClickOnce publish layouts in an isolated temporary directory without changing production signing behavior. Validate all destinations before copying, preserve typed layout associations, safely manage mapping-added suffixes during file-info updates, and restore references and files during cleanup. Separate pure staging-plan construction from filesystem execution and cover path safety, collisions, rollback, lifecycle behavior, and source-tree immutability. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
dtivel
force-pushed
the
dtivel/clickonce-safe-staging
branch
from
September 6, 2026 13:59
b947483 to
37abaea
Compare
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Multi-extension Windows device names can bypass planning validation and reach filesystem operations.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
 |
src/Sign.Core/Tools/ClickOnce/ClickOnceStagingPlanBuilder.cs — Reserved DOS device names with multiple extensions bypass this check:… |
Files not reviewed (1)
- src/Sign.Core/Resources.Designer.cs: Generated file
Validate the portion before the first extension separator so reserved device names cannot bypass staging preflight. Cover a multi-extension reserved directory segment without filesystem side effects. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #1049.
Summary
ResolvedClickOncePublishLayoutwhile preserving its typed deployment, application, payload, and adjacent-executable associations..deploysuffixes while manifest file information is updated, then restore both filenames and references.Design
Staging is mode-neutral. Signing and manifest-update policy remain responsibilities of the later application and deployment orchestration changes.
Planning and execution are separated:
ClickOnceStagingPlanBuilderperforms pure allocation and validation, whileClickOncePublishLayoutStagerperforms copying and reference binding.ClickOnceStagingSessionowns the temporary staging lifecycle and mapped-suffix update scope.Behavior
No production signing behavior or CLI surface is changed. The staging implementation remains dormant until it is integrated by later ClickOnce signing changes.
Testing