If you want your users to download and run your application without going through multiple scary red dialog windows with warnings, you need to sing it.
A lot of information on this topic is scattered all over the web. Microsoft has a good set of articles about it. There are bunch of answered questions on Stack Overflow. But sometimes you just want the short version. So here it is.
- To sing any code you need to buy a code signing certificate.
- Update project settings to sign and timestamp the ClickOnce manifest.
- Add a BeforePublish target into your project to sign the executable before it becomes part of the ClickOnce package.
<Exec Command=""C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\signtool.exe" sign /n "My Name" /t http://timestamp.comodoca.com/authenticode $(ProjectDir)obj\$(ConfigurationName)\$(TargetFileName)" />