title: Securely Signing ClickOnce Applications in Azure DevOps Pipeline
body: <p>I'm trying to do CI/CD in Azure DevOps with a ClickOnce application. How can I securely make my code signing certificate available during the build when using a hosted agent?</p>
  
  <p>Note I'm aware you can use a script as suggested at <a href="https://stackoverflow.com/questions/43547231/visual-studio-team-services-deploymen-buildt-certificate-error">Visual studio team services deploymen/buildt certificate error</a>. However this approach is not secure. The certificate would be loaded into the certificate store of the account the hosted agent is running under. This would allow the agent, and hence other Azure DevOps accounts, to potentially access and use the certificate.</p>