{"record":{"id":"26009d17e6f95ca1","repo":"dotnet/wpf","slug":"sr-morethanonepackagespecificreference","errorCode":null,"errorMessage":"SR.MoreThanOnePackageSpecificReference","messagePattern":"SR\\.MoreThanOnePackageSpecificReference","errorType":"exception","errorClass":"XmlException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs","lineNumber":1183,"sourceCode":"            bool packageReferenceFound = false;\n            TransformChain currentTransformChain;\n\n            foreach (Reference currentReference in references)\n            {\n                //As per the OPC spec, Uri attribute in Reference elements MUST refer using fragment identifiers\n                //This implies that Uri cannot be absolute.\n                if (currentReference.Uri.StartsWith(\"#\", StringComparison.Ordinal))\n                {\n                    //As per the OPC spec, there MUST be exactly one package specific reference to the \n                    //package specific <Object> element \n                    if (string.Equals(currentReference.Uri, XTable.Get(XTable.ID.OpcLinkAttrValue), StringComparison.Ordinal))\n                    {\n                        if (!allowPackageSpecificReferences)\n                            throw new ArgumentException(SR.PackageSpecificReferenceTagMustBeUnique);\n\n                        //If there are more than one package specific tags\n                        if (packageReferenceFound)\n                            throw new XmlException(SR.MoreThanOnePackageSpecificReference);\n                        else\n                            packageReferenceFound = true;\n                    }\n\n                    currentTransformChain = currentReference.TransformChain;\n\n                    for(int j=0; j<currentTransformChain.Count; j++)\n                    {\n                        //As per the OPC spec, only two transforms are supported for the reference tags\n                        if (!IsValidXmlCanonicalizationTransform(currentTransformChain[j].Algorithm))\n                            throw new XmlException(SR.UnsupportedTransformAlgorithm);\n                    }\n                }\n                else\n                    throw new XmlException(SR.InvalidUriAttribute);\n            }\n\n            // If there are zero reference tags or if there wasn't any package specific reference tag            ","sourceCodeStart":1165,"sourceCodeEnd":1201,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs#L1165-L1201","documentation":"XmlDigitalSignatureProcessor.ValidateReferences throws this XmlException when a signature contains more than one package-specific Reference (a fragment URI referencing the package Object). The OPC/XML Digital Signature spec requires exactly one such reference, so additional ones make the signature invalid.","triggerScenarios":"Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:1183 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the signed XML contains exactly one package-specific Reference with a fragment URI to the package Object","Re-create the signature with standards-compliant tooling so only one package reference exists","Treat the XmlException as signature verification failure and reject the package signature"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}