Hi all,
Long-time Magic player here, and a returning MTGO user — my account is **atraxa77**. I played fairly actively across Vintage, Modern and a few other formats before stepping away about six months ago. I'm now looking to come back, but in the meantime I replaced my PC, and I've hit a wall trying to install the client on the new machine. I've done a fair amount of diagnostic work already, so I'm posting the full details in the hope it's useful to the team and to anyone else who runs into this.
**Summary**
The ClickOnce installer fails partway through with "Unable to retrieve application files. Files corrupt in deployment." The files are not corrupt. Windows Smart App Control is blocking `Frames.Framework.dll` because the assembly is not code-signed, and the installer aborts as a result.
**Environment**
- Windows 11, build 10.0.26200 (25H2)
- .NET Framework 4.8.1 (clr.dll 4.8.9337, System.Deployment.dll 4.8.9325)
- MTGO client version 3.4.158.4695, deployment path `.../3.4.158.4695.20260819093632/`
- Fresh machine, no prior MTGO installation, nothing in the ClickOnce store to clear
**Error from the ClickOnce log**
```
System.Deployment.Application.InvalidDeploymentException (ManifestLoad)
- Exception occurred loading manifest from file Frames.Framework.dll:
the manifest may not be valid or the file could not be opened.
at System.Deployment.Application.Manifest.AssemblyManifest.LoadFromInternalManifestFile(String filePath)
at System.Deployment.Application.DownloadManager.ProcessDownloadedFile(...)
--- Inner Exception ---
System.Deployment.Application.DeploymentException (InvalidManifest)
- Cannot load internal manifest from component file.
```
Deployment manifest processing, application manifest processing, runtime detection and the trust request all complete successfully. The failure occurs during `DownloadDependencies`, at the point where ClickOnce validates each downloaded assembly in the temporary download directory.
**Ruling out a corrupted download**
The error message points at file corruption, so I verified the file directly against the application manifest.
Manifest entry:
```xml
<dependentAssembly dependencyType="install" allowDelayedBinding="true"
codebase="Frames.Framework.dll" size="293888">
<assemblyIdentity name="Frames.Framework" version="0.0.0.0"
language="neutral" processorArchitecture="msil" />
<hash>...<dsig
igestValue>R2raDH1DQdsHFbsPZBwZZ7A0L9c=</dsigigestValue></hash>
</dependentAssembly>
```
I downloaded the file manually from the CDN and checked it:
- Size: **293,888 bytes** — exact match
- SHA-1: **476ADA0C7D4341DB0715BB0F641C1967B0342FD7** — exact match for the manifest's base64 digest
So the file arrives byte-for-byte intact. The network path, the CDN and my ISP are all fine, and this is not an antivirus-rewriting-the-file scenario. The ClickOnce error text is misleading here.
**Actual cause**
Attempting to read the assembly identity directly reproduces the failure and names the culprit:
```
PS> [System.Reflection.AssemblyName]::GetAssemblyName("...\Frames.Framework.dll")
Could not load file or assembly 'Frames.Framework.dll' or one of its dependencies.
An Application Control policy has blocked this file.
(Exception from HRESULT: 0x800711C7)
```
Windows Security simultaneously raised: "Part of this app has been blocked — Some features may not work because we can't confirm who published the file that the app tried to load."
Smart App Control state on my machine:
```
HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy\VerifiedAndReputablePolicyState = 1
```
(1 = enforcement mode.)
Smart App Control blocks unsigned code unless it is signed with a certificate chaining to a CA in the Microsoft Trusted Root Program, or unless Microsoft's app intelligence service recognises the binary. `Frames.Framework.dll` carries no `publicKeyToken` and an assembly version of `0.0.0.0`, and it is not code-signed — so SAC refuses to let it load, and the ClickOnce installer cannot validate it.
Notably, it is the first assembly in the manifest with version `0.0.0.0`, alongside `Frames.Framework.Database.dll`, `Frames.Framework.Wpf.dll`, the `Mtgo.Shared.*` assemblies and `WotC.MtGO.Client.Common.dll`. I'd expect all of these to hit the same wall.
**Why this affects only some users**
Smart App Control only activates on a clean Windows 11 install, and only in certain regions. Anyone who upgraded from Windows 10, or whose OEM machine shipped with preinstalled software, will have it off or in evaluation mode and will never see this. New machines with a clean Windows 11 image are the affected population — which is likely to grow over time.
This is a known pattern with other titles: Starfield, Satisfactory and even Microsoft's own Office offline installer have all been blocked by SAC for the same reason (an improperly signed or unsigned component).
**Current workaround, and why it isn't a good one**
Disabling Smart App Control does allow the install to proceed. The problem is that SAC **cannot be re-enabled without a clean reinstall of Windows**. Asking players to permanently give up an OS security layer in order to install the client is a rough ask, and it's not something I'd want to recommend to anyone else.
There's also no per-file exclusion mechanism in SAC, and the usual "right-click → Properties → Unblock" trick doesn't apply, since the files land in a temp directory during install and are cleaned up on failure.
**Request**
Could the team code-sign the client assemblies — particularly the `Frames.Framework.*` and `Mtgo.Shared.*` binaries — with a certificate issued by a CA in the Microsoft Trusted Root Program? That would resolve this cleanly for every affected user without anyone having to weaken their machine's security posture.
Happy to provide the full ClickOnce log, registry state, or run any further diagnostics that would help. Thanks for taking a look.
— atraxa77
Long-time Magic player here, and a returning MTGO user — my account is **atraxa77**. I played fairly actively across Vintage, Modern and a few other formats before stepping away about six months ago. I'm now looking to come back, but in the meantime I replaced my PC, and I've hit a wall trying to install the client on the new machine. I've done a fair amount of diagnostic work already, so I'm posting the full details in the hope it's useful to the team and to anyone else who runs into this.
**Summary**
The ClickOnce installer fails partway through with "Unable to retrieve application files. Files corrupt in deployment." The files are not corrupt. Windows Smart App Control is blocking `Frames.Framework.dll` because the assembly is not code-signed, and the installer aborts as a result.
**Environment**
- Windows 11, build 10.0.26200 (25H2)
- .NET Framework 4.8.1 (clr.dll 4.8.9337, System.Deployment.dll 4.8.9325)
- MTGO client version 3.4.158.4695, deployment path `.../3.4.158.4695.20260819093632/`
- Fresh machine, no prior MTGO installation, nothing in the ClickOnce store to clear
**Error from the ClickOnce log**
```
System.Deployment.Application.InvalidDeploymentException (ManifestLoad)
- Exception occurred loading manifest from file Frames.Framework.dll:
the manifest may not be valid or the file could not be opened.
at System.Deployment.Application.Manifest.AssemblyManifest.LoadFromInternalManifestFile(String filePath)
at System.Deployment.Application.DownloadManager.ProcessDownloadedFile(...)
--- Inner Exception ---
System.Deployment.Application.DeploymentException (InvalidManifest)
- Cannot load internal manifest from component file.
```
Deployment manifest processing, application manifest processing, runtime detection and the trust request all complete successfully. The failure occurs during `DownloadDependencies`, at the point where ClickOnce validates each downloaded assembly in the temporary download directory.
**Ruling out a corrupted download**
The error message points at file corruption, so I verified the file directly against the application manifest.
Manifest entry:
```xml
<dependentAssembly dependencyType="install" allowDelayedBinding="true"
codebase="Frames.Framework.dll" size="293888">
<assemblyIdentity name="Frames.Framework" version="0.0.0.0"
language="neutral" processorArchitecture="msil" />
<hash>...<dsig
igestValue>R2raDH1DQdsHFbsPZBwZZ7A0L9c=</dsigigestValue></hash></dependentAssembly>
```
I downloaded the file manually from the CDN and checked it:
- Size: **293,888 bytes** — exact match
- SHA-1: **476ADA0C7D4341DB0715BB0F641C1967B0342FD7** — exact match for the manifest's base64 digest
So the file arrives byte-for-byte intact. The network path, the CDN and my ISP are all fine, and this is not an antivirus-rewriting-the-file scenario. The ClickOnce error text is misleading here.
**Actual cause**
Attempting to read the assembly identity directly reproduces the failure and names the culprit:
```
PS> [System.Reflection.AssemblyName]::GetAssemblyName("...\Frames.Framework.dll")
Could not load file or assembly 'Frames.Framework.dll' or one of its dependencies.
An Application Control policy has blocked this file.
(Exception from HRESULT: 0x800711C7)
```
Windows Security simultaneously raised: "Part of this app has been blocked — Some features may not work because we can't confirm who published the file that the app tried to load."
Smart App Control state on my machine:
```
HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy\VerifiedAndReputablePolicyState = 1
```
(1 = enforcement mode.)
Smart App Control blocks unsigned code unless it is signed with a certificate chaining to a CA in the Microsoft Trusted Root Program, or unless Microsoft's app intelligence service recognises the binary. `Frames.Framework.dll` carries no `publicKeyToken` and an assembly version of `0.0.0.0`, and it is not code-signed — so SAC refuses to let it load, and the ClickOnce installer cannot validate it.
Notably, it is the first assembly in the manifest with version `0.0.0.0`, alongside `Frames.Framework.Database.dll`, `Frames.Framework.Wpf.dll`, the `Mtgo.Shared.*` assemblies and `WotC.MtGO.Client.Common.dll`. I'd expect all of these to hit the same wall.
**Why this affects only some users**
Smart App Control only activates on a clean Windows 11 install, and only in certain regions. Anyone who upgraded from Windows 10, or whose OEM machine shipped with preinstalled software, will have it off or in evaluation mode and will never see this. New machines with a clean Windows 11 image are the affected population — which is likely to grow over time.
This is a known pattern with other titles: Starfield, Satisfactory and even Microsoft's own Office offline installer have all been blocked by SAC for the same reason (an improperly signed or unsigned component).
**Current workaround, and why it isn't a good one**
Disabling Smart App Control does allow the install to proceed. The problem is that SAC **cannot be re-enabled without a clean reinstall of Windows**. Asking players to permanently give up an OS security layer in order to install the client is a rough ask, and it's not something I'd want to recommend to anyone else.
There's also no per-file exclusion mechanism in SAC, and the usual "right-click → Properties → Unblock" trick doesn't apply, since the files land in a temp directory during install and are cleaned up on failure.
**Request**
Could the team code-sign the client assemblies — particularly the `Frames.Framework.*` and `Mtgo.Shared.*` binaries — with a certificate issued by a CA in the Microsoft Trusted Root Program? That would resolve this cleanly for every affected user without anyone having to weaken their machine's security posture.
Happy to provide the full ClickOnce log, registry state, or run any further diagnostics that would help. Thanks for taking a look.
— atraxa77