dotnet/wpf · error · FileFormatException

Signature structures are corrupted in this package.

Error message

Signature structures are corrupted in this package.

What it means

GetCertificatePart resolves the certificate part via the signature part's relationship of type CertificatePart.RelationshipType. If that relationship is present but its TargetMode is not Internal (i.e. external), the signature structure is considered corrupted and FileFormatException is thrown, since embedded certificates must be internal parts.

Solutions

  1. Resign the package with PackageDigitalSignatureManager.Sign using a supported CertificateEmbeddingOption to rebuild a valid certificate relationship
  2. Catch FileFormatException and treat the signature as unverifiable (VerifyResult result of signature verification will also fail)
  3. Validate package signatures with PackageDigitalSignatureManager.VerifySignatures before relying on certificate data

Example fix

// before
var cert = signature.CertificatePart; // FileFormatException on external relationship
// after
try { var cert = signature.CertificatePart; }
catch (FileFormatException) { /* signature corrupted: treat as untrusted, re-sign if needed */ }
Defensive patterns

Strategy: try-catch

Validate before calling

var rels = signature.SignaturePart.GetRelationshipsByType(CertificatePart.RelationshipType);
bool ok = rels.All(r => r.TargetMode == TargetMode.Internal);
if (!ok) { /* signature corrupted: do not access CertificatePart */ }

Try / catch

try { var part = signature.CertificatePart; }
catch (FileFormatException) { /* treat signature as untrusted/corrupted */ }

Prevention

When it happens

Trigger: Reading Signature.CertificatePart (via CertificateEmbeddingOption path) on a signature whose certificate relationship points to an External target — produced by tampering, bad third-party signers, or manual package editing.

Common situations: Packages signed by non-.NET tools that emit external certificate references; packages modified after signing; truncated/corrupted signature parts.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/cd970e4f35efa0ed. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/PackageDigitalSignature.cs:373

        //
        //  Internal Properties
        //
        //------------------------------------------------------
        /// <summary>
        /// Get certificate part - null if none
        /// </summary>
        internal CertificatePart GetCertificatePart()
        {
            // lazy init
            if (_certificatePart == null && !_alreadyLookedForCertPart)
            {
                PackageRelationshipCollection relationships = SignaturePart.GetRelationshipsByType(
                    CertificatePart.RelationshipType);
                foreach (PackageRelationship relationship in relationships)
                {
                    // don't resolve if external
                    if (relationship.TargetMode != TargetMode.Internal)
                        throw new FileFormatException(SR.PackageSignatureCorruption);

                    Uri resolvedUri = PackUriHelper.ResolvePartUri(SignaturePart.Uri, relationship.TargetUri);

                    // don't create if it doesn't exist
                    if (!_manager.Package.PartExists(resolvedUri))
                    {
                        continue;
                    }

                    // find the cert
                    _certificatePart = new CertificatePart(_manager.Package, resolvedUri);
                    break;
                }
                _alreadyLookedForCertPart = true;
            }
            
            return _certificatePart;
        }

View on GitHub (pinned to 81131a70a4)