{"record":{"id":"63d63c745e68068c","repo":"dotnet/wpf","slug":"sr-packagesignaturecorruption-xmlsignatureproperties","errorCode":null,"errorMessage":"SR.PackageSignatureCorruption","messagePattern":"SR\\.PackageSignatureCorruption","errorType":"exception","errorClass":"System.Xml.XmlException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureProperties.cs","lineNumber":165,"sourceCode":"            DateTime signingTime = DateTime.Now;\n            timeFormat = null;\n            \n            while (reader.Read())\n            {\n                //Looking for <SignatureProperty> tag\n                if (reader.MoveToContent() == XmlNodeType.Element\n                    && (string.Equals(reader.NamespaceURI, w3cSignatureNameSpace, StringComparison.Ordinal))\n                    && (string.Equals(reader.LocalName, signaturePropertyTag, StringComparison.Ordinal))\n                    && reader.Depth == 2)\n                {\n                    //Verify Attributes\n                    //Look for well-defined Id attribute and if it is present \n                    if (VerifyIdAttribute(reader))\n                    {\n                        //If we encounter more than one <SignatureProperty> tag with the expected\n                        //id, then its an error.\n                        if (signatureTimeIdFound)\n                            throw new XmlException(SR.PackageSignatureCorruption);\n                        else\n                            signatureTimeIdFound = true;\n                        \n                        //VerifyTargetAttribute will return false, if the Target attribute is missing\n                        //or contains an incorrect value.\n                        if(VerifyTargetAttribute(reader, signatureId))\n                        {\n                            signingTime = ParseSignatureTimeTag(reader, out timeFormat);\n                            signatureTimePropertyFound = true;\n                        }\n                    }\n                }\n                else\n                    //Expected <SignatureProperty> tag not found.\n                    //Look for end tag corresponding to </SignatureProperty> or \n                    //if these are other custom defined properties, then anything with\n                    //depth greater than 2 should be ignored as these can be nested elements.\n                    if (((string.Equals(signaturePropertyTag, reader.LocalName, StringComparison.Ordinal)","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureProperties.cs#L147-L183","documentation":"ParseSigningTime parses the <SignatureProperty> section that carries the signing time of a package signature. PackageSignatureCorruption is thrown when a second <SignatureProperty> tag with the expected well-defined Id appears — the OPC signature format allows at most one such signature-time property, so duplicates mean the signature part is corrupt or non-conformant.","triggerScenarios":"Signature validation on a package whose <SignatureProperties> contains more than one <SignatureProperty> element with the expected signing-time Id attribute value.","commonSituations":"Signature XML duplicated by buggy signing tools or merge artifacts; files concatenated/edited after signing; producers that append extra signature properties with a conflicting Id.","solutions":["Remove the duplicate <SignatureProperty> element with the signing-time Id from the signature part","Re-sign the package so a single conformant signing-time property is generated","Validate the signature XML against the OPC digital signature schema before distribution","Reject the signature as corrupt at validation time if you can't fix the source"],"exampleFix":"// before\n<SignatureProperty Id=\"SignatureTime\" Target=\"#id1\">...</SignatureProperty>\n<SignatureProperty Id=\"SignatureTime\" Target=\"#id1\">...</SignatureProperty> <!-- duplicate -->\n// after\n<SignatureProperty Id=\"SignatureTime\" Target=\"#id1\">...</SignatureProperty>","handlingStrategy":"try-catch","validationCode":"bool HasSingleSigningTimeProperty(XElement sigProps) =>\n    sigProps.Elements().Count(e =>\n        (string)e.Attribute(\"Id\") == \"SignatureTime\") <= 1;","typeGuard":null,"tryCatchPattern":"try { var time = ReadSigningTime(package); }\ncatch (XmlException ex) when (ex.Message.Contains(\"corrupt\")) { /* treat signature as corrupt; show warning to user */ }","preventionTips":["Never merge or concatenate signature parts from multiple signing passes","Schema-validate signatures before distribution","Regenerate signatures rather than patching them"],"tags":["xml","digital-signature","corruption"],"backgroundTag":"schema-validation-failed","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}