dotnet/wpf · error · XmlException

SR.PackageSignatureCorruption

Error message

SR.PackageSignatureCorruption

What it means

System.IO.Packaging throws this XmlException while parsing a PackageDigitalSignature's XMLDSig manifest when the <SignedInfo>/<References> section contains no <Reference> element at all. The XMLDSig schema mandates at least one Reference per signature, so a signature without any is structurally corrupt and cannot be verified.

Solutions

  1. Re-generate the signature properly with PackageDigitalSignatureManager.Sign so every part is covered by a <Reference> element
  2. Inspect the /_xmlsignatures/*.xml parts in the package and confirm each <SignedInfo> contains at least one <Reference>; fix or remove the corrupt signature part
  3. Remove the invalid signature (PackageDigitalSignatureManager.RemoveSignature) and re-sign the package
  4. Verify the package was not modified after signing; restore it from a known-good copy

Example fix

// before (corrupt signedInfo emitted manually)
// <SignedInfo>...no Reference elements...</SignedInfo>
// after: use the signing API instead of hand-crafted XML
// using (PackageDigitalSignatureManager dsm = new PackageDigitalSignatureManager(package))
//     dsm.Sign(partUris); // emits a <Reference> per part
Defensive patterns

Strategy: try-catch

Validate before calling

using var pkg = Package.Open(path, FileMode.Open, FileAccess.Read);
var dsm = new PackageDigitalSignatureManager(pkg);
foreach (var sigUri in dsm.Signatures)
{
    var part = pkg.GetPart(sigUri);
    using var sr = new StreamReader(part.GetStream());
    string xml = sr.ReadToEnd();
    if (!xml.Contains("<Reference")) throw new InvalidDataException("Signature part has no Reference elements");
}

Try / catch

try
{
    foreach (var sig in package.GetDigitalSignatures()) Verify(sig);
}
catch (XmlException ex) when (ex.Message.Contains("PackageSignatureCorruption") || ex.Message.Contains("PackageSignatureCorruption"))
{
    // treat the package as unsigned; re-sign or reject
}

Prevention

When it happens

Trigger: Opening or verifying a package signature whose OpcSignature/SignedInfo XML has zero <Reference> child elements; ParseManifest counts references while reading and throws when referenceCount == 0 after the element loop.

Common situations: Hand-edited or tool-mangled signature XML inside an OPC package (e.g. a .docx or .oxps re-zipped incorrectly), a signature generated by a non-Open Packaging Conventions compliant signer that omits References, or truncated/corrupted package parts modified after signing.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/8869860eac45591b. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs:146

                    {
                        foreach (PackageRelationshipSelector relationshipSelector in partManifestEntry.RelationshipSelectors)
                            relationshipManifest.Add(relationshipSelector);
                    }
                    else
                        partManifest.Add(partManifestEntry.Uri);

                    // return the manifest entry to be used for hashing
                    partEntryManifest.Add(partManifestEntry);

                    referenceCount++;
                }
                else
                    throw new XmlException(SR.Format(SR.UnexpectedXmlTag, reader.Name));
            }

            // XmlDSig xsd requires at least one <Reference> tag
            if (referenceCount == 0)
                throw new XmlException(SR.PackageSignatureCorruption);
        }

        /// <summary>
        /// Parse the DigestMethod tag
        /// </summary>
        /// <param name="reader"></param>
        private static string ParseDigestAlgorithmTag(XmlReader reader)
        {
            // verify namespace and lack of attributes
            if (PackagingUtilities.GetNonXmlnsAttributeCount(reader) > 1
                || !string.Equals(reader.NamespaceURI, SignedXml.XmlDsigNamespaceUrl, StringComparison.Ordinal)
                || reader.Depth != 3)
                throw new XmlException(SR.XmlSignatureParseError);

            // get the Algorithm attribute
            string hashAlgorithm = null;
            if (reader.HasAttributes)
            {

View on GitHub (pinned to 81131a70a4)