{"record":{"id":"14cfe1419e8d342d","repo":"dotnet/wpf","slug":"sr-rightsmanagementencryptiontransformnotfound","errorCode":null,"errorMessage":"SR.RightsManagementEncryptionTransformNotFound","messagePattern":"SR\\.RightsManagementEncryptionTransformNotFound","errorType":"exception","errorClass":"SystemException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/CompoundFile/StorageInfo.cs","lineNumber":299,"sourceCode":"        if (manager != null)\n        {\n            //case : Compression option is set. Stream need to be compressed. Define compression transform.\n            //At this time, we only treat CompressionOption - Normal and None. The rest are treated as Normal\n            if (compressionOption != CompressionOption.NotCompressed)\n            {\n                //If it is not defined already, define it.\n                if (!manager.TransformLabelIsDefined(sc_compressionTransformName))\n                        manager.DefineTransform(CompressionTransform.ClassTransformIdentifier, sc_compressionTransformName);                \n            }\n             //case : Encryption option is set. Stream need to be encrypted. Define encryption transform.\n            if (encryptionOption == EncryptionOption.RightsManagement)\n            {\n                //If it not defined already, define it.\n                if (!manager.TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName))\n                {\n                    //We really cannot define RM transform completely here because the transform initialization cannot be done here without publishlicense and cryptoprovider.\n                    //However it will always be defined because this method is accessed only through an EncryptedPackageEnvelope and RM transform is always defined in EncryptedPackageEnvelope.Create()\n                    throw new SystemException(SR.RightsManagementEncryptionTransformNotFound);\n                }\n            }\n\n            //Now find the dataspace label that we need to define these transforms in.\n            //CASE: When both CompressionOption and EncryptionOption are set\n            if ( (compressionOption != CompressionOption.NotCompressed) && (encryptionOption == EncryptionOption.RightsManagement) )\n            {\n                dataSpaceLabel = sc_dataspaceLabelRMEncryptionNormalCompression;\n                if (!manager.DataSpaceIsDefined(dataSpaceLabel))\n                {\n                    string[] transformStack = new string[2];\n                    //compress the data first. then encrypt it. This ordering will cause the content to be compressed, then encrypted, then written to the stream.\n                    transformStack[0] = EncryptedPackageEnvelope.EncryptionTransformName;\n                    transformStack[1] = sc_compressionTransformName; \n\n                    manager.DefineDataSpace(transformStack, dataSpaceLabel);\n                }\n            }","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/CompoundFile/StorageInfo.cs#L281-L317","documentation":"Thrown by StorageInfo.CreateStream when a stream is requested with EncryptionOption.RightsManagement but the Rights Management encryption transform label is not defined in the compound file's DataSpaceManager. The library cannot define the RM transform itself because transform initialization requires a publish license and crypto provider, so it assumes EncryptedPackageEnvelope.Create() has already registered it. Hitting this exception means the compound file was not created through the normal EncryptedPackageEnvelope path.","triggerScenarios":"Calling CreateStream with encryptionOption == EncryptionOptionRightsManagement on a compound file whose DataSpaceManager does not have the 'RightsManagementEncryptionTransform' label defined (TransformLabelIsDefined returns false).","commonSituations":"Manipulating an RM-protected compound file's storages/streams directly via StorageInfo/StreamInfo APIs instead of going through EncryptedPackageEnvelope; opening a file where the RM transform section was stripped or the file was created by another producer without the transform defined.","solutions":["Create/open the compound file via EncryptedPackageEnvelope.Create/Open so the RM transform is defined before adding streams","Do not pass EncryptionOption.RightsManagement to CreateStream unless the file is an RM envelope; use CompressionOption and encryption omitted for plain streams","Verify TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName) on Root.GetDataSpaceManager() before attempting to create the encrypted stream","If building the file by hand, define the RM transform with the publish license and crypto provider first, exactly as EncryptedPackageEnvelope.Create does"],"exampleFix":"// before\nstorageInfo.CreateStream(\"\\u0006DataSpaces/TransformInfo\", CompressionOption.NotCompressed, EncryptionOption.RightsManagement);\n// after\nusing (var envelope = EncryptedPackageEnvelope.Create(path, publishLicense))\n{\n    // create streams through the envelope so the RM transform exists\n}","handlingStrategy":"validation","validationCode":"var manager = root.GetDataSpaceManager();\nif (manager == null || !manager.TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName))\n    throw new InvalidOperationException(\"RM transform not defined; open the file through EncryptedPackageEnvelope\");","typeGuard":"bool RmTransformDefined(StorageInfo root) => root.GetDataSpaceManager()?.TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName) == true;","tryCatchPattern":"try { storage.CreateStream(name, CompressionOption.NotCompressed, EncryptionOption.RightsManagement); }\ncatch (SystemException ex) { /* fallback: route through EncryptedPackageEnvelope */ }","preventionTips":["Always create RM-protected packages through EncryptedPackageEnvelope.Create","Never pass EncryptionOption.RightsManagement on plain (non-envelope) compound files","Validate the dataspace transform labels before writing encrypted streams"],"tags":["wpf","packaging","rights-management","compound-file"],"backgroundTag":"missing-dependency","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}