VSTO Deployment Manifest (.vsto)

Question

I have developed VSTO Document Level Adins. I have signed .dll file using .pfx file using Signtool. Is it required to sign VSTO Deployment Manifest (.vsto) file also? Or is it ok with signing only .dll file?

Answer 1

If you make changes to deployment dlls you also need to resign the manifest files. You can do this using Mage.

To just sign the manifest you can do:

mage -Sign ManifestFileName -CertFile Certificate -Password Password

like:

mage -Sign ExcelAddin1.vsto -CertFile ..\ExcelAddIn1_TemporaryKey.pfx

this comes from https://msdn.microsoft.com/en-us/library/cc175513%28v=vs.90%29.aspx

However if you change the dll's in a post production such as obfuscation or ilmerge, you will need to update the manifest and resign everything. For that see https://msdn.microsoft.com/en-us/library/dd465299.aspx;

You will want to also sign the .vsto manifest file, especially if you have a trusted cert, otherwise Excel will give warnings that the addin is coming from an trusted source.

Answer 2

Only the .DLL is signed. The manifest and vsto are companion files to the .dll. No action is required on them.

When deployed, it requires both the .vsto file and manifest in order to load.