dotnet/wpf · error · ArgumentException

Specified object ID conflicts with predefined Package…

Error message

Specified object ID conflicts with predefined Package Object ID.

What it means

VerifySignArguments checks each DataObject's Id against the reserved OPC object identifier ('http://schemas.openxmlformats.org/package/2006/digital-signature/origin'); a match throws ArgumentException (SR.SignaturePackageObjectTagMustBeUnique) for the signatureObjects parameter. The OPC specification reserves that object ID for the package-specific signature object, so user data objects cannot use it.

Solutions

Rename the DataObject.Id to a custom, non-reserved XML NCName (e.g. 'myObject1').
Remove the conflicting DataObject if it was only meant as boilerplate — the OPC origin object is created by the framework automatically.
Add a pre-sign validation that rejects Ids equal to the reserved OPC identifier.

Example fix

// before
var obj = new DataObject { Id = "http://schemas.openxmlformats.org/package/2006/digital-signature/origin" };
mgr.Sign(cert, parts, obj); // ArgumentException
// after
var obj = new DataObject { Id = "myCustomObject1" };
mgr.Sign(cert, parts, obj);

Defensive patterns

Strategy: validation

Validate before calling

const string OpcReservedId = "http://schemas.openxmlformats.org/package/2006/digital-signature/origin";
if (sigObjects?.Any(o => string.Equals(o.Id, OpcReservedId, StringComparison.Ordinal)) == true)
    throw new InvalidOperationException("DataObject Id collides with reserved OPC object id.");

Try / catch

try { mgr.Sign(cert, parts, null, sigObjects, null); }
catch (ArgumentException ex) when (ex.ParamName == "signatureObjects") { /* rename object ids */ }

Prevention

Never reuse the OPC origin object Id in user DataObjects.
Use custom NCName ids like 'obj1' for your objects.
The framework creates the OPC origin object automatically — don't add it yourself.

When it happens

Trigger: Calling Sign() with a signatureObjects collection containing a DataObject whose Id equals the reserved OPC object identifier.

Common situations: Copy-pasting XML-DSig sample objects that reuse the OPC object Id; programmatically generating DataObjects with the framework's reserved Id string.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/355f2d9f9ef69ce6. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/PackageDigitalSignatureManager.cs:959

            IEnumerable<System.Security.Cryptography.Xml.DataObject> signatureObjects,
            IEnumerable<System.Security.Cryptography.Xml.Reference> objectReferences)
        {
            ArgumentNullException.ThrowIfNull(certificate);

            // Check for empty collections in order to provide negative feedback as soon as possible.
            if (EnumeratorEmptyCheck(parts) && EnumeratorEmptyCheck(relationshipSelectors)
                && EnumeratorEmptyCheck(signatureObjects) && EnumeratorEmptyCheck(objectReferences))
                throw new ArgumentException(SR.NothingToSign);

            // check for illegal and/or duplicate id's in signatureObjects
            if (signatureObjects != null)
            {
                List<String> ids = new List<String>();
                foreach (DataObject obj in signatureObjects)
                {
                    // ensure they don't duplicate the reserved one
                    if (string.Equals(obj.Id, XTable.Get(XTable.ID.OpcAttrValue), StringComparison.Ordinal))
                        throw new ArgumentException(SR.SignaturePackageObjectTagMustBeUnique, nameof(signatureObjects));

                    // check for duplicates
                    //if (ids.Contains(obj.Id))
                    if (ids.Exists(new StringMatchPredicate(obj.Id).Match))
                        throw new ArgumentException(SR.SignatureObjectIdMustBeUnique, nameof(signatureObjects));
                    else
                        ids.Add(obj.Id);
                }
            }

            // ensure id is legal Xml id
            if (!string.IsNullOrEmpty(signatureId))
            {
                try
                {
                    // An XSD ID is an NCName that is unique.
                    System.Xml.XmlConvert.VerifyNCName(signatureId);
                }

View on GitHub (pinned to 81131a70a4)