Secure Application Deployment
Releasing a WPF application with TX Text Control means putting files on computers you don't control. Anything in the installer can be read there, so credentials and licensing files must stay out, and every component you ship should be current and known. The checks below come from the license agreement, from how the Text Control Private NuGet Feed authenticates and from Text Control's articles on packaging and SBOMs. The Deployment Guide covers building the installer or package itself.
Before the Release
| Check | Reason | Details |
|---|---|---|
| The installer holds your files and the redistributable runtime files, nothing else | Licensing credentials and the development license must not reach users | Ship Only the Runtime Files |
| No nuget.config with an API token in the repository, the build output or the installer | The token opens the private feed under your name | Keep Feed Credentials Out of Builds |
| No signing certificate or its password in the installation, unless every user may sign with it | A private key signs for whoever holds it | Certificate and Private Key Handling |
| The application gets only the access it needs, for example in an MSIX AppContainer | Isolation limits what the application can reach | Run the Application in an AppContainer |
TXTextControl.TextControl.WPF.SDK has the latest service pack | Service packs bring fixes | Keep TX Text Control Current |
| The components of the release are known | When a vulnerability becomes known, the list of components shows whether your application is affected | Check the Components You Ship |
Ship Only the Runtime Files
Under the license agreement, you may distribute your compiled applications with the runtime components that Text Control designates as redistributable, and nothing more: serial numbers, the license file txtextcontrol.wpf.license and a nuget.config with your API token never go to your users. Because the license is compiled into your assembly, the installed application runs without any of these files and without activation. What Stays Out of the Installer has the complete list, and Redistribution Overview lists the runtime files.
Keep Feed Credentials Out of Builds
The personal nuget.config of the Text Control Private NuGet Feed contains a developer's email address and API token:
- Not in the repository. Build servers keep the email address, the API token and the feed URL as secrets of the CI/CD system and write nuget.config before the restore, as Build Servers shows.
- Not in the output. Look for nuget.config in the build output and in the installer before you publish them.
- Replaced when leaked. If a token or a nuget.config was shared by mistake, delete the token under Manage API tokens in your Text Control account and create a new one, as Text Control Private NuGet Feed describes along with the validity of tokens.
Restoring from Text Control Offline Packages, the package folder the full setup installs, needs no credentials at all. Configuring Package Sources compares the sources.
Run the Application in an AppContainer
A desktop application normally has full access to the user's resources, such as the camera, the microphone, the location and personal data. Text Control's article Secure and Deploy .NET Windows Forms Apps with MSIX AppContainer Apps points out that .NET lets Windows Forms and WPF applications run in an AppContainer instead, isolated and with access only to the resources their package declares. Run in an AppContainer shows the settings of the packaging project.
Keep TX Text Control Current
Each service pack comes with a new version of TXTextControl.TextControl.WPF.SDK, such as 34.0.5 for Service Pack 5. A project stays on the version it references until you update it; dotnet list package --outdated shows which packages have a newer version, and Update to a New Service Pack shows the update. .NET Framework projects, which reference the assemblies of the setup, get a service pack when you install the latest full setup and rebuild, as Install a Service Pack describes.
Check the Components You Ship
Starting with version 34.0, Text Control offers signed SBOMs (software bills of materials) for its NuGet packages, TXTextControl.TextControl.WPF.SDK among them. The blog article Signed CycloneDX SBOMs for CRA Compliance Available for Text Control Products describes them:
- Files. The SBOM is a CycloneDX JSON file ending in .cyclonedx.json. A detached PKCS#7 signature, ending in .cyclonedx.json.p7s, lets you verify that it is authentic and unchanged.
- Content. Package name and version, supplier, first-party and third-party dependencies including transitive ones, contained third-party native libraries, licensing metadata and the dependency graph.
- How to get them. Customers with an active subscription ask the Text Control support or sales team for the SBOMs of their licensed products.
Tools that understand CycloneDX compare the components with vulnerability databases. The other packages of your project are checked by the .NET SDK, including the packages they depend on:
dotnet list package
The command reports vulnerabilities that package sources such as nuget.org provide data for. Microsoft explains the options in Auditing package dependencies for security vulnerabilities.
Next Steps
- Deployment Guide: the files, installers and packages of a WPF application.
- Application Licensing: the license of the installed application.
- CI/CD: builds and packages on a build server.
- Security Overview: where security applies in a WPF application with TX Text Control.