dotnet/wpf · error · FileFormatException

Signature structures are corrupted in this package.

Error message

Signature structures are corrupted in this package.

What it means

DeleteCertificateIfReferenceCountBecomesZeroVisitor is a relationship visitor used while removing signatures; if a relationship it walks is external (TargetMode != Internal) where an internal certificate part reference is required, it throws FileFormatException (SR.PackageSignatureCorruption), meaning the package's digital-signature structures are inconsistent or tampered with.

Solutions

Catch FileFormatException around RemoveSignature/RemoveAllSignatures and treat the package as corrupt — do not attempt further signature edits.
Rebuild or re-export the package from its source application to regenerate conformant signature structures.
If you control package production, ensure certificate relationships created for signatures always use TargetMode.Internal.

Example fix

// before
mgr.RemoveAllSignatures(); // FileFormatException on corrupt package
// after
try { mgr.RemoveAllSignatures(); pkg.Flush(); }
catch (FileFormatException ex)
{
    log.Error("Package signature structures are corrupted", ex);
}

Defensive patterns

Strategy: try-catch

Validate before calling

bool HasExternalCertRelationships(Package pkg) =>
    pkg.GetRelationships().Any(r => r.TargetMode == TargetMode.External);

Try / catch

try { mgr.RemoveSignature(uri); }
catch (FileFormatException ex) { /* signature structures corrupted — quarantine package */ }

Prevention

Treat FileFormatException during signature ops as package corruption, not a transient error.
Validate packages from third-party producers before editing signatures.
Keep certificate relationships TargetMode.Internal when authoring packages.

When it happens

Trigger: Removing signatures (RemoveSignature/RemoveAllSignatures traversal) from a package whose signature-origin/certificate relationships point to external targets instead of internal parts — a corrupted or hand-edited OPC signature infrastructure.

Common situations: Packages modified by third-party tools that rewrote relationships, files damaged by partial downloads or manual zip editing, or non-conformant producers of signed OPC packages.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/6bee493d2f310872. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/PackageDigitalSignatureManager.cs:1088

            // now invoke the delegate for each member
            for (int i = 0; i < relationshipsToVisit.Count; i++)
            {
                // exit if visitor wants us to
                if (!visit(relationshipsToVisit[i], context))
                    break;
            }
        }

        /// <summary>
        /// Removes the certificate associated with the given signature if removing the signature would leave the
        /// certificate part orphaned.
        /// </summary>
        private bool DeleteCertificateIfReferenceCountBecomesZeroVisitor(PackageRelationship r, Object context)
        {
            // don't resolve if external
            if (r.TargetMode != TargetMode.Internal)
                throw new FileFormatException(SR.PackageSignatureCorruption);
            
            Uri certificatePartName = PackUriHelper.ResolvePartUri(r.SourceUri, r.TargetUri);
            if (CertificatePartReferenceCount(certificatePartName) == 1)    // we are part of the calculation so one is the magic number
                _container.DeletePart(certificatePartName);                 // will not throw if part not found

            return true;
        }

        /// <summary>
        /// Deletes any relationship that is of the type that relates a Package to the Digital Signature Origin
        /// </summary>
        /// <param name="r"></param>
        /// <param name="context"></param>
        /// <returns></returns>
        private bool DeleteRelationshipOfTypePackageToOriginVisitor(PackageRelationship r, Object context)
        {
            Debug.Assert(Uri.Compare(r.SourceUri, 
                                     MS.Internal.IO.Packaging.PackUriHelper.PackageRootUri,

View on GitHub (pinned to 81131a70a4)