SOX compliance in VB .Net application publishing

Question

I have an application that we have been using for some time now but now need to be SOX compliant. At this time I have two connection strings in the App.config that I manually change (along with information in the properties (publish screen and tabs) when I want the application to connect to the Development or Production environment. I publish it under two different application names (App_Test / AppName_Production) and to two different folders on the Intranet (LAN). This works just fine. The operators get to safely test the new enhancements and when they are happy I change (comment out and uncomment) the settings and republish the production version. ClickOnce tracks the versions and takes care of everything.

Now, with SOX, I can not publish to the Production environment. I need to publish the application to a folder; have someone else who is not a developer pick it up and put it into a Secure Folder that I do not have access to; and have it (ClickOnce) take care of checking for a new version for the users.

Can I continue to do it exactly the same as I am except for the person putting it into a Secure Folder (with the Publish.htm file that I am creating each time) and will it still work with the paths I am using or will it break?

Answer 1

Usually, for changing the deployment place, you also need to update the update location for the ClickOnce application and other things.

For more details you can look into the following two links:

http://robindotnet.wordpress.com/2010/01/17/how-to-move-a-clickonce-deployment/

http://social.msdn.microsoft.com/Forums/en-US/winformssetup/thread/5309f67e-efe4-40b4-b937-aed18cf87155/

Since I'm not sure your situation and now familiar about the SOX compliance.

But you can give it a try, and show us your test results.

 

If there's any concern, please feel free to let us know.

Have a nice day!

---

Mike [MSFT]
MSDN Community Support | Feedback to us
Get or Request Code Sample from Microsoft
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 2

AnOldGuy,

I am writing to check the status of the issue on your side. 

What about this problem now? 

Would you mind letting us know the result of the suggestions?

Best wishes,

---

Mike [MSFT]
MSDN Community Support | Feedback to us
Get or Request Code Sample from Microsoft
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 3

These answers do not quite fit the situation. According to SOX, I am not allowed to publish an application, that I made code changes to, to the Production environment. I must publish to a folder that I have access to. Then someone else who is not a developer must pick it up and move it to a folder that I do not have access to. Other than that, everything about Click Once should work the same. When the operators of the program open it in the morning the app should check for updates and go to the folder, that I do not have acces to and can not publish to, and get the updated app. If the publish operation puts something in the app to make sure it is secure than just changing the manifests paths manually won't work.

Answer 4

Do you mean you tried the second suggestion?

I would like you to show us the test result after you tried the second suggestion.

Please do not forgot to sign the manifests after you modified them. And please follow the steps the link displayed.

And you need to use the Mage.exe or MageUI.exe tool to modify the manifest, if you just let others modify them use notepad, then I don't think so it can work.

And base on my experience, if you want change the location, then we must use tools modify them.

And I suggest you use the MageUI.exe tool to modify the path strings, it is a visual tool, rather than the Mage.exe is just a command line tool.

Maybe that post cannot quite fit your situation, but it shows you a way to modify the published files to let it work after move to another places.

 

If there's any concern, please feel free to let us know.

Best wishes,

---

Mike [MSFT]
MSDN Community Support | Feedback to us
Get or Request Code Sample from Microsoft
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 5

AnOldGuy,

I am writing to check the status of the issue on your side. 

What about this problem now? 

Would you mind letting us know the result of the suggestions?

best wishes,

---

Mike [MSFT]
MSDN Community Support | Feedback to us
Get or Request Code Sample from Microsoft
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 6

Sorry, I wear many hats and have not had a chance to test this. I will get bact to it as soon as I can. Thanks for the assistance. I'll get back to you as soon as I can.

Answer 7

Fine, I will go on to follow this thread if you have any updates.

 

Best wishes,

---

Mike [MSFT]
MSDN Community Support | Feedback to us
Get or Request Code Sample from Microsoft
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 8

Hi,

All you need to do is set your publishing file location to a folder, but set the installation url to the http link currently used by the user. Then publish it. It will put it in the folder, and someone else can pick it up and put it out on the server. They need to move the setup.exe, the deployment manifest (.application file), and the versioned folder out of the Application Files folder.

You could also check out this article by Saurabh Bhatia, who knows everything ClickOnce, about using different app.config files for different build configurations:

http://blogs.msdn.com/b/vsto/archive/2010/03/09/tricks-with-app-config-and-clickonce-deployment-saurabh-bhatia.aspx

I don't know if that would make it through the Sox compliance, but it might, since you're not changing anything.

RobinDotNet

---

Click here to visit my ClickOnce blog!
Microsoft MVP, Client App Dev

Answer 9

Thank you for your input. As I work through this I find I am bombarded with other, more important, fires to put out. I will try your suggestions as soon as I can and get back to you. Thank you, again.