Precompiling ASP.NET WebForms and MVC Views with MSBuild

Compilation Guide

You can precompile ASP.NET WebForms and MVC Views using the Publish feature in Visual Studio. You automate the precompilation using the MSBUILD command-line tool.

To automate with MSBUILD, use Visual Studio to precompile your ASP.NET application and generate the .pubxml file, which is created in your Properties > PublishProfiles folder in your ASP.NET Web project.

The following is an example PUBXML file. You can download a copy here:https://tools.veracode.com/integrations/Microsoft/VisualStudio/update/VeracodePrecompileProfile.zip


The following table describes the PUBXML file values:

Element Value
WebPublishMethod REQUIRED - Set to FileSystem so that the precompiled files are written to the local filesystem.
PublishProvider REQUIRED - Set to FileSystem so that the precompiled files are written to the local filesystem.
LastUsedBuildConfiguration Set to Debug. This value is set by the Publish option in Visual Studio to track the last Build Configuration that the Veracode Platform used last time. You should set this value to the Build Configuration you need to target.
LastUsedPlatform Set to Any CPU. This value is set by the Publish option in Visual Studio to track the last used platform. This value should be set to the platform the user needs to target.
SiteUrlToLaunchAfterPublish N/A
LaunchSiteAfterPublish N/A
ExcludeApp_Data Set this value to the requirements for your project.
publishUrl REQUIRED - This value is the filepath to which the precompiled assemblies are written. This value is the location where you pick up the files to zip up and upload to the Veracode Platform.
PrecompileBeforePublish REQUIRED - Set to True to precompile the ASPX WebForms or the CSHTML views.
DeleteExistingFiles If set to True, the output directory (publishUrl) is purged before output is written to it. Veracode recommends to start out with a clean slate.
EnableUpdateable REQUIRED - Set to False, otherwise the CSHTML View/ASPX WebForm is still editable, which results in new compilation and use of the View or WebForm.
DebugSymbols REQUIRED - You must set this to True to retain the debug symbols.
WDPMergeOption REQUIRED - You must set this to CreateSeparateAssembly, which instructs the compiler to create an assembly for each page or view.
UseFixedNames REQUIRED - You must set this to True, which instructs the compiler to allow all the separately created assemblies to start with the same name.
UseMerge If present, you must set this value to False, you do not want to merge any of the output.
Run MSBuild, providing the appropriate arguments for the CSPROJECT file and the following properties:
  • OutPutPath
  • DeployOnBuild
  • PublishProfile

    You can also specify the PublishProfile property as a name instead of a path to a file. Other switches may be needed, depending on your environment and/or requirements.

Precompiling Without a PUBXML Configuration File by Using a VS Project File

There is a way to precompile and package ASP.NET WebForms and MVC Views without the .pubxml file.

The following example uses a .csprojfile to precompile, merge, and then package it in a deployment ZIP file:

C:\Code\ContosoUniversity>msbuild ContosoUniversity.csproj

/p:OutputPath=bin /p:DeployOnBuild=true

/p:PublishProvider="FileSystem";PrecompileBeforePublish=true;

EnableUpdateable=false;DebugSymbols=true;

WDPMergeOption="CreateSeparateAssembly";UseFixedNames=true

You can use the above example to build a web project if you substitute the .csproj name and use these specific parameters and values from the command line:

C:\ContosoUniversity>msbuild ContosoUniversity.csproj

/p:OutputPath=bin

/p:DeployOnBuild=true

/p:WebPublishMethod="FileSystem";PrecompileBeforePublish=true;EnableUpdateable=false;

DebugSymbols=true

/p:UseMerge=false;WDPMergeOption="CreateSeparateAssembly";

/p:WebPublishMethod="FileSystem";

The ZIP file contains all the assemblies needed to deploy the web application. You can also upload this ZIP file to the Veracode Platform. Based on the command line in the example above, the deployment package is in a subfolder under the output path: bin\_PublishedWebsites\ContosoUniversity_Package\ContosoUniversity.zip.

Precompiling Without a PUBXML Configuration File by Using a Solution File

To use MSBuild directly on a Visual Studio solution file that has multiple projects, you must precompile with debug, as required by Veracode. You can use the following example:
C:\Code\ContosoUniversity>msbuild ContosoUniversity.csproj
/p:OutputPath=bin /p:DeployOnBuild=true /p:PublishProvider="FileSystem";
PrecompileBeforePublish=true;EnableUpdateable=false;DebugSymbols=true;
WDPMergeOption="CreateSeparateAssembly";UseFixedNames=true

You can use the above example to build an entire Visual Studio solution including the web projects, if you substitute the Visual Studio (VS) solution:

C:\Code\WebApplication14>msbuild <solution file>
/t:Rebuild /tv:14.0
/p:OutputPath=bin /p:DeployOnBuild=true
/p:WebPublishMethod=FileSystem
/p:PrecompileBeforePublish=true;EnableUpdateable=false;DebugSymbols=true
/p:UseMerge=false;DeleteAppCodeCompiledFiles=True;DeleteExistingFiles=True;WDPMergeOption=CreateSeparateAssembly
/p:UseFixedNames=true

Change the /t: and /tv: parameters to specify the required targets and the version of Visual Studio you are using. For example, /tv:14.0 is Visual Studio 2015 and /tv:12.0 is Visual Studio 2013.

Using the Veracode API Wrappers from the Command Line

Use the uploadandscan action from the API wrapper to help automate uploading the .NET application to Veracode.