dotnet/wpf · error · XmlException

SR.MoreThanOnePackageSpecificReference

Error message

SR.MoreThanOnePackageSpecificReference

What it means

XmlDigitalSignatureProcessor.ValidateReferences throws this XmlException when a signature contains more than one package-specific Reference (a fragment URI referencing the package Object). The OPC/XML Digital Signature spec requires exactly one such reference, so additional ones make the signature invalid.

Solutions

1. Ensure the signed XML contains exactly one package-specific Reference with a fragment URI to the package Object
2. Re-create the signature with standards-compliant tooling so only one package reference exists
3. Treat the XmlException as signature verification failure and reject the package signature

When it happens

Trigger: Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:1183 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/26009d17e6f95ca1. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:1183

            bool packageReferenceFound = false;
            TransformChain currentTransformChain;

            foreach (Reference currentReference in references)
            {
                //As per the OPC spec, Uri attribute in Reference elements MUST refer using fragment identifiers
                //This implies that Uri cannot be absolute.
                if (currentReference.Uri.StartsWith("#", StringComparison.Ordinal))
                {
                    //As per the OPC spec, there MUST be exactly one package specific reference to the 
                    //package specific <Object> element 
                    if (string.Equals(currentReference.Uri, XTable.Get(XTable.ID.OpcLinkAttrValue), StringComparison.Ordinal))
                    {
                        if (!allowPackageSpecificReferences)
                            throw new ArgumentException(SR.PackageSpecificReferenceTagMustBeUnique);

                        //If there are more than one package specific tags
                        if (packageReferenceFound)
                            throw new XmlException(SR.MoreThanOnePackageSpecificReference);
                        else
                            packageReferenceFound = true;
                    }

                    currentTransformChain = currentReference.TransformChain;

                    for(int j=0; j<currentTransformChain.Count; j++)
                    {
                        //As per the OPC spec, only two transforms are supported for the reference tags
                        if (!IsValidXmlCanonicalizationTransform(currentTransformChain[j].Algorithm))
                            throw new XmlException(SR.UnsupportedTransformAlgorithm);
                    }
                }
                else
                    throw new XmlException(SR.InvalidUriAttribute);
            }

            // If there are zero reference tags or if there wasn't any package specific reference tag            

View on GitHub (pinned to 81131a70a4)