dotnet/wpf · error · ArgumentException

Must specify an item to sign.

Error message

Must specify an item to sign.

What it means

The two-parameter Sign overload (parts and relationshipSelectors) requires at least one of its inputs to be non-null; both being null means there is nothing to include in the signature, so it throws ArgumentException (SR.NothingToSign).

Solutions

1. Pass at least one PackagePart in the parts list or at least one PackageRelationshipSelector in relationshipSelectors
2. Guard with a null check on both arguments before calling Sign
3. If you intend to sign the entire package, enumerate the package parts and pass them
4. Catch ArgumentException and surface a clear 'nothing selected to sign' message to the user

Example fix

// before
manager.Sign(parts, cert, selectors, null); // both parts and selectors may be null
// after
bool hasParts = parts != null && parts.Any();
bool hasSelectors = selectors != null && selectors.Any();
if (hasParts || hasSelectors)
    manager.Sign(parts, cert, selectors, null);

if ((parts == null || !parts.Any()) && (selectors == null || !selectors.Any()))
    throw new ArgumentException("Specify at least one part or relationship selector to sign.");

try { manager.Sign(parts, cert, selectors, null); }
catch (ArgumentException ex) when (ex.Message.Contains("sign")) { log.Error("Nothing to sign", ex); }

When it happens

Trigger: Calling Sign(null, certificate, null, signatureId) — i.e. both the parts collection and the relationshipSelectors collection are null.

Common situations: Passing variables that were initialized to null on a code path where content selection failed; conditional logic that skipped populating the parts list; refactoring that removed the actual items but left the Sign call.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Can only countersign parts with Digital Signature…
• Duplicates not allowed - signature part already exists.
• Parameter cannot be a zero-length string.
• SR.TransformStackValid
• The given data space label name is already in use.

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/c1a574f7883fa1b7. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/PackageDigitalSignatureManager.cs:396

        /// Sign - certificate provided by caller
        /// </summary>
        /// <param name="parts">list of parts to sign - may be empty or null</param>
        /// <param name="certificate">signer's certificate</param>
        /// <param name="relationshipSelectors">relationshipSelectors that hold information about 
        /// the relationships to be signed - may be empty or null</param>
        /// <param name="signatureId">id for the new Signature - may be empty or null</param>  
        /// <remarks>one of parts or relationships must be non-null and contain at least a single entry</remarks>
        public PackageDigitalSignature Sign(
            IEnumerable<Uri> parts,
            X509Certificate certificate,
            IEnumerable<PackageRelationshipSelector> relationshipSelectors,
            String signatureId)
        {
            // Cannot both be null - need to check here because the similar check in the super-overload cannot
            // distinguish to this level.
            if (parts == null && relationshipSelectors == null)
            {
                throw new ArgumentException(SR.NothingToSign);
            }

            return Sign(parts, certificate, relationshipSelectors, signatureId, null, null);
        }

        /// <summary>
        /// Sign - caller specifies custom "Object" and/or SignedInfo "Reference" tags
        /// </summary>
        /// <param name="parts">list of parts to sign - may be empty or null</param>
        /// <param name="certificate">signer's certificate</param>
        /// <param name="relationshipSelectors">relationshipSelectors that hold information about 
        /// the relationships to be signed - may be empty or null</param>
        /// <param name="signatureId">id for the new Signature - may be empty or null</param>  
        /// <param name="objectReferences">references to custom object tags.  The DigestMethod on each
        /// Reference will be ignored.  The signature will use the globally defined HashAlgorithm
        /// obtained from the current value of the HashAlgorithm property.</param>
        /// <param name="signatureObjects">objects (signed or not)</param>
        /// <exception cref="InvalidOperationException">Thrown if any TransformMapping

View on GitHub (pinned to 81131a70a4)