Secure Application Deployment
Before a Windows Forms application with TX Text Control goes to its users, a few checks keep secrets out of the installer and known problems out of the components. Some come from the license agreement, which names files that must never ship; others come from how packages reach your build and how Windows can isolate an application. The checklist below names each point and why it matters; the Deployment Guide has the complete steps for installers, MSIX and build pipelines.
The Checklist
| Check | Why | Read |
|---|---|---|
| The installer contains only redistributable runtime files and your own files | The license agreement forbids shipping licensing credentials and the development license | Ship Only the Runtime Files |
| No nuget.config with an API token is in source control, the build output or the installer | The token gives access to the Text Control Private NuGet Feed | Keep Feed Credentials Out of Builds |
| Signing certificates and their passwords aren't part of the installation, unless every user may sign with them | Whoever has the key can sign in its owner's name | Certificate and Private Key Handling |
| The application runs with the access it needs, for example in an MSIX AppContainer | An isolated application can't reach resources it wasn't granted | Run the Application in an AppContainer |
| The TX Text Control package is on the latest service pack | Service packs contain fixes | Keep TX Text Control Current |
| You know the components you ship | When a vulnerability becomes known, the list of components shows whether your application is affected | Check the Components You Ship |
Ship Only the Runtime Files
The license agreement lets you ship the runtime files that Text Control designates as redistributable and forbids giving your users licensing credentials, the license file or your nuget.config. The license is compiled into your assembly, so the installed application needs none of them. Redistribution Overview lists the files an application ships, and Keep Licensing Information Out of the Deployment the files to check for before a release.
Keep Feed Credentials Out of Builds
The Text Control Private NuGet Feed authenticates each developer with an email address and an API token, and the personal nuget.config you download contains both:
- Keep nuget.config out of source control. On a build server, store the email address, the API token and the feed URL as secrets of the CI/CD system and create nuget.config from them before the restore, as Build Servers describes.
- Check the build output and the installer for nuget.config before you release them.
- Replace a leaked token. If a token or a nuget.config was shared by mistake, delete the token under Manage API tokens in your Text Control account and create a new one. Tokens also expire, as Text Control Private NuGet Feed describes.
Projects that use Text Control Offline Packages, the local package folder installed by the setup, need no credentials for the restore. Configuring Package Sources compares both sources.
Run the Application in an AppContainer
By default, a Windows Forms application has full access to the resources of the user, such as the camera, the microphone, the location and the user's data. Packaged with MSIX and set to partial trust, it runs in an AppContainer instead, where it's isolated and reaches only the capabilities its package requests. Enable only the capabilities your application needs. Run the Application in an AppContainer shows the steps.
Keep TX Text Control Current
A service pack brings a new version of TXTextControl.TextControl.WinForms.SDK, such as 34.0.5 for Service Pack 5, and your project keeps the version it references until you update it. dotnet list package --outdated lists the packages that have a newer version, and Installing and Updating Packages shows the update. .NET Framework projects, which reference the assemblies of the setup, get a service pack when you install the latest full setup and rebuild, as Install a Service Pack describes.
Check the Components You Ship
Text Control provides signed software bills of materials (SBOMs) for its NuGet packages starting with version 34.0, TXTextControl.TextControl.WinForms.SDK included, as the blog article Signed CycloneDX SBOMs for CRA Compliance Available for Text Control Products announces:
- Format. Each SBOM is a JSON file in the CycloneDX format, .cyclonedx.json, with a detached PKCS#7 signature, .cyclonedx.json.p7s, that shows whether it is authentic and unchanged.
- Content. It lists the package and its version, its supplier, its first-party and third-party dependencies including transitive ones, the third-party native libraries it contains, licensing metadata and a dependency graph.
- Availability. Customers with an active subscription request the SBOMs of their licensed products from the Text Control support or sales team.
Tools that read CycloneDX check the listed components against vulnerability databases. For the other packages of your project, the .NET SDK lists those with known vulnerabilities, including the packages they bring in:
dotnet list package
The vulnerability data comes from package sources that provide it, such as nuget.org. Microsoft describes the options in Auditing package dependencies for security vulnerabilities.
Next Steps
- Deployment Guide: installers, MSIX, the runtime files and build pipelines.
- Application Licensing: the license in the deployed application.
- CI/CD: build and package the application on a build server.
- Security Overview: how the parts of an application fit into its security.