{"record":{"id":"08a2ddb2a4861f93","repo":"dotnet/wpf","slug":"sr-signatureobjectidmustbeunique","errorCode":null,"errorMessage":"SR.SignatureObjectIdMustBeUnique","messagePattern":"SR\\.SignatureObjectIdMustBeUnique","errorType":"exception","errorClass":"XmlException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs","lineNumber":1049,"sourceCode":"\n        /// <summary>\n        /// Finds and return the package-specific Object tag\n        /// </summary>\n        /// <returns></returns>\n        private DataObject GetPackageDataObject()\n        {\n            EnsureXmlSignatureParsed();\n\n            // look for the Package-specific object tag\n            String opcId = XTable.Get(XTable.ID.OpcAttrValue);\n            DataObject returnValue = null;\n            foreach (DataObject dataObject in _signedXml.Signature.ObjectList)\n            {\n                if (string.Equals(dataObject.Id, opcId, StringComparison.Ordinal))\n                {\n                    // duplicates not allowed\n                    if (returnValue != null)\n                        throw new XmlException(SR.SignatureObjectIdMustBeUnique);\n\n                    returnValue = dataObject;\n                }\n            }\n\n            // Package object tag required\n            if (returnValue != null)\n                return returnValue;\n            else\n                throw new XmlException(SR.PackageSignatureObjectTagRequired);\n        }\n\n        private KeyInfo GenerateKeyInfo(AsymmetricAlgorithm key, X509Certificate2 signer)\n        {\n            // KeyInfo section\n            KeyInfo keyInfo = new KeyInfo();\n            KeyInfoName keyInfoName = new KeyInfoName\n            {","sourceCodeStart":1031,"sourceCodeEnd":1067,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs#L1031-L1067","documentation":"GetPackageDataObject scans the signature's ObjectList for the DataObject whose Id is the OPC package object id. Two DataObjects with the same Id make the selection ambiguous, so XmlException(SR.SignatureObjectIdMustBeUnique) is thrown: per XML DSig, Object element Id attributes must be unique within a signature.","triggerScenarios":"Verify or property access on a PackageSignature whose SignedXml Signature.ObjectList contains two or more <Object> elements sharing the package object Id (the OPC-reserved id), e.g. after custom code appended a second Object with the same Id.","commonSituations":"Custom signing code that adds its own Object without changing the Id; repeated application of a signing step that appends instead of replaces; merging signatures from two documents.","solutions":["Re-sign the package with PackageDigitalSignatureManager.Sign so a single, unique package Object is generated.","If adding custom Objects, assign each a distinct Id attribute different from the OPC package object Id.","Inspect the signature XML and remove the duplicate <Object> element with the reserved Id.","Treat the signature as corrupt and remove it (dsm.RemoveSignature(sig)) if it cannot be repaired."],"exampleFix":"// before: duplicate Ids\n<Object Id=\"idPackageObject\">...</Object>\n<Object Id=\"idPackageObject\">...</Object>\n// after: unique Ids\n<Object Id=\"idPackageObject\">...</Object>\n<Object Id=\"myCustomObject\">...</Object>","handlingStrategy":"validation","validationCode":"var ids = doc.SelectNodes(\"//*[local-name()='Object']/@Id\")\n              .Cast<XmlAttribute>().Select(a => a.Value).ToList();\nbool unique = ids.Count == ids.Distinct().Count();","typeGuard":"static bool ObjectIdsUnique(XmlDocument doc) =>\n    doc.SelectNodes(\"//*[local-name()='Object']/@Id\").Cast<XmlAttribute>()\n       .GroupBy(a => a.Value).All(g => g.Count() == 1);","tryCatchPattern":"try { dsm.VerifySignatures(true); }\ncatch (XmlException ex) { /* duplicate Object Id — remove and re-sign */ }","preventionTips":["Give every custom Object element a unique Id.","Never append Objects with the OPC-reserved package object Id.","Detect duplicates by scanning Id attributes before verification.","Re-sign to regenerate a clean ObjectList."],"tags":["wpf","xml-signature","duplicate-id","opc"],"backgroundTag":"schema-validation-failed","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}