I have a custom .net software used by a small number of people with many different projects and shared access to the source on github. I had the idea to make some feature available in outlook by building a VSTO add-ins. I have no need to sign this add-in but it seems no mandatory by outlook (2017).
My issue is that Signing this assembly (ticked Sign the clickONce manifests and ticked Sign the assembly in Visual studio 2015 project properties) required me to sign the dependent projects which end up in signing every single project. If I don't sign a single dependent project I can still build the VSTO addin but I loose all functionalities. Even something as simple as a click on a button that displays a MessageBox.Show("Test!");
That would be inconvenient but all right if this was the end of the story but when committing the solution it occurs sometimes that we have issues with .pfx file and need to resign every single project. It's helpful to add the .pfx in my gitignore but signing every project the first time I pull the repository is a pain.
I have tried to read and understand how signing work but I haven't found an answer to this question: what is the best practice to manage the signing when you bring it in only because it's mandatory for a VSTO add-in and you wish you did not have to ?
