{"record":{"id":"555175ffb9ce5300","repo":"dotnet/wpf","slug":"reachpackaging-signingdoesnotmeetpolicy","errorCode":null,"errorMessage":"ReachPackaging_SigningDoesNotMeetPolicy","messagePattern":"ReachPackaging_SigningDoesNotMeetPolicy","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/ReachFramework/Packaging/XpsDocument.cs","lineNumber":858,"sourceCode":"        private\n        XpsDigitalSignature\n        SignDigitally(\n            X509Certificate                         certificate,\n            bool                                    embedCertificate,\n            XpsDigSigPartAlteringRestrictions       restrictions,\n            String                                  signatureId,\n            bool                                    testIsSignable\n            )\n        {\n            ArgumentNullException.ThrowIfNull(certificate);\n\n            if( CurrentXpsManager == null )\n            {\n                throw new InvalidOperationException(SR.ReachPackaging_DocumentWasClosed);\n            }\n            if( testIsSignable && !IsSignable )\n            {\n                throw new InvalidOperationException(SR.ReachPackaging_SigningDoesNotMeetPolicy);              \n            }\n            EnsureSignatures();\n            //\n            // List of RelationshipSelectors that need to be signed\n            //\n            List<PackageRelationshipSelector> selectorList =  \n                new List<PackageRelationshipSelector>();\n\n            //\n            // This is being used as a Set class so the second Uri Value is irrelevent\n            //\n            Dictionary<Uri,Uri> dependentList = new Dictionary<Uri,Uri> ();\n            CollectSelfAndDependents( dependentList, selectorList,  restrictions );\n\n            PackageDigitalSignature packSignature =\n                CurrentXpsManager.Sign(dependentList.Keys,\n                                         certificate,\n                                         embedCertificate,","sourceCodeStart":840,"sourceCodeEnd":876,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/ReachFramework/Packaging/XpsDocument.cs#L840-L876","documentation":"XpsDocument.SignDigitally throws InvalidOperationException when signing is requested but the document does not satisfy the signing policy. The IsSignable check rejects signing when the package contains parts or state that the XPS signing policy forbids (e.g. content that would make the signature invalid). It guards against creating a signature that is invalid under the OPC/XPS digital-signature policy.","triggerScenarios":"Calling XpsDocument.SignDigitally (with testIsSignable=true) on a document whose IsSignable property is false — typically after the document or its package parts were modified, or when the document structure disallows adding signatures.","commonSituations":"Re-signing an already-signed XPS after editing content; signing a document opened in a mode that disallows signing; automated XPS signing pipelines where prior writes invalidated signability.","solutions":["Check the XpsDocument.IsSignable property before calling SignDigitally and abort or re-create the document if it returns false.","Avoid modifying document content between opening/creating the XpsDocument and signing it.","Re-open the package read-write from disk in its original, unmodified state and sign before making any edits.","If the caller passed testIsSignable=false deliberately, verify the resulting signature afterwards; consider keeping testIsSignable=true."],"exampleFix":"// before\nxpsDoc.SignDigitally(cert, true, DigestAlgorithm.Sha1Uri);\n// after\nif (!xpsDoc.IsSignable)\n    throw new InvalidOperationException(\"Document state does not permit signing; re-open without modifications.\");\nxpsDoc.SignDigitally(cert, true, DigestAlgorithm.Sha1Uri);","handlingStrategy":"validation","validationCode":"if (!xpsDoc.IsSignable)\n    throw new InvalidOperationException(\"Document cannot be signed as-is.\");","typeGuard":null,"tryCatchPattern":"try { xpsDoc.SignDigitally(cert, true, DigestAlgorithm.Sha256Uri); }\ncatch (InvalidOperationException ex) { /* document not signable: reopen unmodified and retry or fail */ }","preventionTips":["Check IsSignable before every signing call.","Never mutate package parts between open and sign.","Sign documents as the final step after all content writes."],"tags":["wpf","xps","digital-signature","invalid-operation"],"backgroundTag":"invalid-state-transition","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}