{"record":{"id":"cd970e4f35efa0ed","repo":"dotnet/wpf","slug":"signature-structures-are-corrupted-in-this-package","errorCode":null,"errorMessage":"Signature structures are corrupted in this package.","messagePattern":"Signature structures are corrupted in this package\\.","errorType":"exception","errorClass":"FileFormatException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/PackageDigitalSignature.cs","lineNumber":373,"sourceCode":"        //\n        //  Internal Properties\n        //\n        //------------------------------------------------------\n        /// <summary>\n        /// Get certificate part - null if none\n        /// </summary>\n        internal CertificatePart GetCertificatePart()\n        {\n            // lazy init\n            if (_certificatePart == null && !_alreadyLookedForCertPart)\n            {\n                PackageRelationshipCollection relationships = SignaturePart.GetRelationshipsByType(\n                    CertificatePart.RelationshipType);\n                foreach (PackageRelationship relationship in relationships)\n                {\n                    // don't resolve if external\n                    if (relationship.TargetMode != TargetMode.Internal)\n                        throw new FileFormatException(SR.PackageSignatureCorruption);\n\n                    Uri resolvedUri = PackUriHelper.ResolvePartUri(SignaturePart.Uri, relationship.TargetUri);\n\n                    // don't create if it doesn't exist\n                    if (!_manager.Package.PartExists(resolvedUri))\n                    {\n                        continue;\n                    }\n\n                    // find the cert\n                    _certificatePart = new CertificatePart(_manager.Package, resolvedUri);\n                    break;\n                }\n                _alreadyLookedForCertPart = true;\n            }\n            \n            return _certificatePart;\n        }","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/PackageDigitalSignature.cs#L355-L391","documentation":"GetCertificatePart resolves the certificate part via the signature part's relationship of type CertificatePart.RelationshipType. If that relationship is present but its TargetMode is not Internal (i.e. external), the signature structure is considered corrupted and FileFormatException is thrown, since embedded certificates must be internal parts.","triggerScenarios":"Reading Signature.CertificatePart (via CertificateEmbeddingOption path) on a signature whose certificate relationship points to an External target — produced by tampering, bad third-party signers, or manual package editing.","commonSituations":"Packages signed by non-.NET tools that emit external certificate references; packages modified after signing; truncated/corrupted signature parts.","solutions":["Resign the package with PackageDigitalSignatureManager.Sign using a supported CertificateEmbeddingOption to rebuild a valid certificate relationship","Catch FileFormatException and treat the signature as unverifiable (VerifyResult result of signature verification will also fail)","Validate package signatures with PackageDigitalSignatureManager.VerifySignatures before relying on certificate data"],"exampleFix":"// before\nvar cert = signature.CertificatePart; // FileFormatException on external relationship\n// after\ntry { var cert = signature.CertificatePart; }\ncatch (FileFormatException) { /* signature corrupted: treat as untrusted, re-sign if needed */ }","handlingStrategy":"try-catch","validationCode":"var rels = signature.SignaturePart.GetRelationshipsByType(CertificatePart.RelationshipType);\nbool ok = rels.All(r => r.TargetMode == TargetMode.Internal);\nif (!ok) { /* signature corrupted: do not access CertificatePart */ }","typeGuard":null,"tryCatchPattern":"try { var part = signature.CertificatePart; }\ncatch (FileFormatException) { /* treat signature as untrusted/corrupted */ }","preventionTips":["Verify signatures with PackageDigitalSignatureManager.VerifySignatures before reading certificate parts","Resign packages with supported CertificateEmbeddingOption values","Avoid post-signing manual edits to package parts and relationships"],"tags":["wpf","packaging","digital-signature","corruption"],"backgroundTag":"schema-validation-failed","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-22T01:17:13.364Z"}