使用SignTool与MageUi签名后部署引用与应用清单身份不匹配

错误日志 #

SOURCES
    Deployment url          : file:///C:/dev/SignAndPublish/artifactsWOTimeAll/bin/T3NAPackage/T3Services_Dev/T3ClientInstall/T3Client_DEV.application
    Application url         : file:///C:/dev/SignAndPublish/artifactsWOTimeAll/bin/T3NAPackage/T3Services_Dev/T3ClientInstall/Application%20Files/T3Client_DEV_2_0_0_573/T3Client_DEV.exe.manifest

IDENTITIES
    Deployment Identity     : T3Client_DEV.application, Version=2.0.0.573, Culture=en, PublicKeyToken=0000000000000000, processorArchitecture=x86

APPLICATION SUMMARY
    * Installable application.

ERROR SUMMARY
    Below is a summary of the errors, details of these errors are listed later in the log.
    * Activation of C:\dev\SignAndPublish\artifactsWOTimeAll\bin\T3NAPackage\T3Services_Dev\T3ClientInstall\T3Client_DEV.application resulted in exception. Following failure messages were detected:
        + Reference in the deployment does not match the identity defined in the application manifest. 

COMPONENT STORE TRANSACTION FAILURE SUMMARY
    No transaction error was detected.

WARNINGS
    * The manifest for this application does not have a signature. Signature validation will be ignored.

OPERATION PROGRESS STATUS
    * [9/14/2023 11:08:19 AM] : Activation of C:\dev\SignAndPublish\artifactsWOTimeAll\bin\T3NAPackage\T3Services_Dev\T3ClientInstall\T3Client_DEV.application has started.
    * [9/14/2023 11:08:19 AM] : Processing of deployment manifest has successfully completed.
    * [9/14/2023 11:08:19 AM] : Installation of the application has started.

ERROR DETAILS
    Following errors were detected during this operation.
    * [9/14/2023 11:08:19 AM] System.Deployment.Application.InvalidDeploymentException (SubscriptionSemanticValidation)
        - Reference in the deployment does not match the identity defined in the application manifest. 
        - Source: System.Deployment
        - Stack trace:
            at System.Deployment.Application.DownloadManager.DownloadApplicationManifest(AssemblyManifest deploymentManifest, String targetDir, Uri deploymentUri, IDownloadNotification notification, DownloadOptions options, Uri& appSourceUri, String& appManifestPath)
            at System.Deployment.Application.ApplicationActivator.DownloadApplication(SubscriptionState subState, ActivationDescription actDesc, Int64 transactionId, TempDirectory& downloadTemp)
            at System.Deployment.Application.ApplicationActivator.InstallApplication(SubscriptionState& subState, ActivationDescription actDesc)
            at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(Uri activationUri, Boolean isShortcut, String textualSubId, String deploymentProviderUrlFromExtension, BrowserSettings browserSettings, String& errorPageUrl, Uri& deploymentUri)
            at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivationWithRetry(Uri activationUri, Boolean isShortcut, String textualSubId, String deploymentProviderUrlFromExtension, BrowserSettings browserSettings, String& errorPageUrl)
--- End of stack trace from previous location where exception was thrown ---
            at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
            at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivationWithRetry(Uri activationUri, Boolean isShortcut, String textualSubId, String deploymentProviderUrlFromExtension, BrowserSettings browserSettings, String& errorPageUrl)
            at System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(Object state)

COMPONENT STORE TRANSACTION DETAILS
    No transaction information is available.

解决方案 #

1. 解决“部署引用与应用清单身份不匹配”错误 #

• 核对清单身份信息
  打开部署清单（.application）和应用清单（.exe.manifest），确保以下字段完全一致：

  • Version（示例中为2.0.0.573）
  • Culture（示例中为en）
  • PublicKeyToken（日志中显示为全0，说明签名未正确应用，需确保签名后公钥一致）
  • processorArchitecture（示例中为x86）

• 重新按正确流程生成并签名清单

  1. 先验证.exe签名有效性：

     signtool verify /pa T3Client_DEV.exe
     

  2. 使用MageUi.exe重新处理应用清单：
     • 加载现有应用清单，确认Identity信息无误后，用代码签名证书重新签名
  3. 处理部署清单：
     • 加载部署清单，更新对应用清单的引用，确保引用的Identity与应用清单完全匹配，再用同一代码签名证书签名部署清单
  4. 注意：任何清单修改后必须重新签名，且部署清单和应用清单必须使用同一证书签名

2. 确保安装时显示发布者名称 #

• 使用受信任的代码签名证书
  必须使用正规CA机构颁发的代码签名证书（如DigiCert、GlobalSign），自签名证书无法显示发布者名称，还会触发安全警告。
• 同时签名部署清单和应用清单
  仅签名应用清单不够，部署清单（.application）也需用同一证书签名，ClickOnce才能识别发布者信息。
• 验证签名有效性
  分别验证两个清单的签名：

  signtool verify /pa /v T3Client_DEV.application
  signtool verify /pa /v T3Client_DEV.exe.manifest
  

  确认证书状态为“受信任”，且证书Subject字段包含正确的组织名称（即发布者名称）

内容的提问来源于stack exchange，提问作者Himanshu Kumar