{"record":{"id":"f242f1162da2076c","repo":"dotnet/wpf","slug":"sr-packagesignatureobjecttagrequired","errorCode":null,"errorMessage":"SR.PackageSignatureObjectTagRequired","messagePattern":"SR\\.PackageSignatureObjectTagRequired","errorType":"exception","errorClass":"XmlException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs","lineNumber":1059,"sourceCode":"            String opcId = XTable.Get(XTable.ID.OpcAttrValue);\n            DataObject returnValue = null;\n            foreach (DataObject dataObject in _signedXml.Signature.ObjectList)\n            {\n                if (string.Equals(dataObject.Id, opcId, StringComparison.Ordinal))\n                {\n                    // duplicates not allowed\n                    if (returnValue != null)\n                        throw new XmlException(SR.SignatureObjectIdMustBeUnique);\n\n                    returnValue = dataObject;\n                }\n            }\n\n            // Package object tag required\n            if (returnValue != null)\n                return returnValue;\n            else\n                throw new XmlException(SR.PackageSignatureObjectTagRequired);\n        }\n\n        private KeyInfo GenerateKeyInfo(AsymmetricAlgorithm key, X509Certificate2 signer)\n        {\n            // KeyInfo section\n            KeyInfo keyInfo = new KeyInfo();\n            KeyInfoName keyInfoName = new KeyInfoName\n            {\n                Value = signer.Subject\n            };\n            keyInfo.AddClause(keyInfoName);               // human readable Principal name\n\n            // Include the public key information (if we are familiar with the algorithm type)\n            if (key is RSA)\n                keyInfo.AddClause(new RSAKeyValue((RSA)key));    // RSA key parameters\n            else\n            {\n                if (key is DSA)","sourceCodeStart":1041,"sourceCodeEnd":1077,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs#L1041-L1077","documentation":"GetPackageDataObject must locate the OPC package-specific <Object> element (identified by the reserved package object Id) in the signature. If no DataObject with that Id exists, XmlException(SR.PackageSignatureObjectTagRequired) is thrown, because the OPC profile mandates a package Object tag containing Manifest and SignatureProperties.","triggerScenarios":"Verify or property access (SigningTime, TimeFormat, PartManifest, RelationshipManifest) on a signature that lacks the package-specific Object element — e.g. a bare XML DSig signature generated without the OPC extensions, or a signature whose Object Id was altered.","commonSituations":"Signatures generated by generic XML DSig tooling instead of the OPC-aware .NET signing API; post-processing that renamed or removed the Object Id attribute; verifying third-party signed packages not conformant to the OPC profile.","solutions":["Re-sign the package using PackageDigitalSignatureManager.Sign, which always emits the required package Object tag.","If the Id attribute was edited, restore it to the OPC-reserved package object Id (idPackageObject).","Confirm the package is an OPC (Open Packaging Conventions) package rather than one signed with an ad-hoc scheme.","Remove non-conformant signatures and require partners to sign with an OPC-compliant tool."],"exampleFix":"// before: plain DSig Object without OPC Id\n<Object>...</Object>\n// after: sign with OPC manager\nvar dsm = new PackageDigitalSignatureManager(pkg);\ndsm.Sign(toSign, cert); // emits <Object Id=\"idPackageObject\">","handlingStrategy":"validation","validationCode":"bool hasPackageObject = doc.SelectSingleNode(\n    \"//*[local-name()='Object' and @Id='idPackageObject']\") != null;","typeGuard":"static bool HasOpcPackageObject(XmlDocument doc) =>\n    doc.SelectSingleNode(\"//*[local-name()='Object' and @Id='idPackageObject']\") != null;","tryCatchPattern":"try { var valid = dsm.VerifySignatures(true); }\ncatch (XmlException ex) { /* no package Object tag — signature not OPC-conformant */ }","preventionTips":["Only sign OPC packages with PackageDigitalSignatureManager.Sign.","Reject external signatures that lack the package Object element.","Do not rename or strip the reserved Object Id.","Document the OPC signature requirement for partner integrations."],"tags":["wpf","xml-signature","opc","missing-element"],"backgroundTag":"schema-validation-failed","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}