{"record":{"id":"0e14a5614bb6e3bc","repo":"dotnet/wpf","slug":"the-stream-on-which-the-encrypted-package-is-created-must","errorCode":null,"errorMessage":"The stream on which the encrypted package is created must have read/write access.","messagePattern":"The stream on which the encrypted package is created must have read/write access\\.","errorType":"exception","errorClass":"NotSupportedException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/EncryptedPackage.cs","lineNumber":97,"sourceCode":"            Stream envelopeStream,\n            PublishLicense publishLicense,\n            CryptoProvider cryptoProvider\n            )\n        {\n            ArgumentNullException.ThrowIfNull(envelopeStream);\n\n            ThrowIfRMEncryptionInfoInvalid(publishLicense, cryptoProvider);\n\n            _root = StorageRoot.CreateOnStream(envelopeStream, _defaultFileModeForCreate);\n\n            //\n            // CreateOnStream opens the stream for read access if it's readable, and for\n            // read/write access if it's writable. We're going to need it to be writable,\n            // so check that it is.\n            //\n            if (_root.OpenAccess != FileAccess.ReadWrite)\n            {\n                throw new NotSupportedException(SR.StreamNeedsReadWriteAccess);\n            }\n\n            InitializeRMForCreate(publishLicense, cryptoProvider);\n            EmbedPackage(null);\n        }\n\n        /// <summary>\n        /// Constructor. Create an EncryptedPackageEnvelope on the compound file, using\n        /// an existing package as the content.\n        /// </summary>\n        /// <param name=\"envelopeFileName\">\n        /// The path name of the compound file being created to hold the encrypted package.\n        /// </param>\n        /// <param name=\"packageStream\">\n        /// A stream containing an unencrypted package which is to be stored in\n        /// the compound file being created in <paramref name=\"envelopeFileName\"/>.\n        /// </param>\n        /// <param name=\"publishLicense\">","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/EncryptedPackage.cs#L79-L115","documentation":"EncryptedPackageEnvelope wraps an OLE compound-file stream via OpenPackage on the given stream. When constructing on a stream, the underlying root container must be open for FileAccess.ReadWrite because encrypted package creation embeds and writes package data. If the stream was opened read-only, the constructor throws NotSupportedException.","triggerScenarios":"Calling EncryptedPackageEnvelope.CreateOnStream (or the create constructor taking publishLicense/cryptoProvider) with a Stream whose OpenAccess is FileAccess.Read or Read-only, e.g. a FileStream opened with FileAccess.Read or MemoryStream wrapped read-only.","commonSituations":"Opening the source file with File.OpenRead/FileStream read-only by habit; passing a stream obtained from a read-only resource such as an embedded assembly resource or downloaded-from-web buffer; share/permission restrictions on Windows forcing read-only access.","solutions":["Open the stream with FileAccess.ReadWrite (e.g. new FileStream(path, FileMode.OpenOrCreate, FileAccess.ReadWrite)) before calling CreateOnStream","Check stream.CanWrite and the effective OpenAccess before calling; if read-only, copy to a writable MemoryStream/FileStream first","Remove ReadOnly file attributes or fix NTFS/share permissions so the file can be opened read-write"],"exampleFix":"// before\nusing var fs = File.OpenRead(\"doc.xlsx\");\nvar env = EncryptedPackageEnvelope.CreateOnStream(fs, license, provider); // throws\n// after\nusing var fs = new FileStream(\"doc.xlsx\", FileMode.OpenOrCreate, FileAccess.ReadWrite);\nvar env = EncryptedPackageEnvelope.CreateOnStream(fs, license, provider);","handlingStrategy":"validation","validationCode":"if (!stream.CanWrite)\n    throw new InvalidOperationException(\"Stream must be writable to create an encrypted package envelope.\");","typeGuard":"bool IsWritable(Stream s) => s != null && s.CanWrite;","tryCatchPattern":"try { var env = EncryptedPackageEnvelope.CreateOnStream(stream, license, provider); }\ncatch (NotSupportedException ex) { /* stream opened read-only: reopen with FileAccess.ReadWrite */ }","preventionTips":["Always open envelope container streams with FileAccess.ReadWrite","Check Stream.CanWrite before create calls","Avoid File.OpenRead / embedded resource streams as container streams"],"tags":["wpf","packaging","file-access","rights-management"],"backgroundTag":"incompatible-source-type","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}