dotnet/wpf · error · XmlException

SR.PackageSignatureObjectTagRequired

Error message

SR.PackageSignatureObjectTagRequired

What it means

GetPackageDataObject must locate the OPC package-specific <Object> element (identified by the reserved package object Id) in the signature. If no DataObject with that Id exists, XmlException(SR.PackageSignatureObjectTagRequired) is thrown, because the OPC profile mandates a package Object tag containing Manifest and SignatureProperties.

Solutions

  1. Re-sign the package using PackageDigitalSignatureManager.Sign, which always emits the required package Object tag.
  2. If the Id attribute was edited, restore it to the OPC-reserved package object Id (idPackageObject).
  3. Confirm the package is an OPC (Open Packaging Conventions) package rather than one signed with an ad-hoc scheme.
  4. Remove non-conformant signatures and require partners to sign with an OPC-compliant tool.

Example fix

// before: plain DSig Object without OPC Id
<Object>...</Object>
// after: sign with OPC manager
var dsm = new PackageDigitalSignatureManager(pkg);
dsm.Sign(toSign, cert); // emits <Object Id="idPackageObject">
Defensive patterns

Strategy: validation

Validate before calling

bool hasPackageObject = doc.SelectSingleNode(
    "//*[local-name()='Object' and @Id='idPackageObject']") != null;

Type guard

static bool HasOpcPackageObject(XmlDocument doc) =>
    doc.SelectSingleNode("//*[local-name()='Object' and @Id='idPackageObject']") != null;

Try / catch

try { var valid = dsm.VerifySignatures(true); }
catch (XmlException ex) { /* no package Object tag — signature not OPC-conformant */ }

Prevention

When it happens

Trigger: Verify or property access (SigningTime, TimeFormat, PartManifest, RelationshipManifest) on a signature that lacks the package-specific Object element — e.g. a bare XML DSig signature generated without the OPC extensions, or a signature whose Object Id was altered.

Common situations: Signatures generated by generic XML DSig tooling instead of the OPC-aware .NET signing API; post-processing that renamed or removed the Object Id attribute; verifying third-party signed packages not conformant to the OPC profile.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/f242f1162da2076c. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:1059

            String opcId = XTable.Get(XTable.ID.OpcAttrValue);
            DataObject returnValue = null;
            foreach (DataObject dataObject in _signedXml.Signature.ObjectList)
            {
                if (string.Equals(dataObject.Id, opcId, StringComparison.Ordinal))
                {
                    // duplicates not allowed
                    if (returnValue != null)
                        throw new XmlException(SR.SignatureObjectIdMustBeUnique);

                    returnValue = dataObject;
                }
            }

            // Package object tag required
            if (returnValue != null)
                return returnValue;
            else
                throw new XmlException(SR.PackageSignatureObjectTagRequired);
        }

        private KeyInfo GenerateKeyInfo(AsymmetricAlgorithm key, X509Certificate2 signer)
        {
            // KeyInfo section
            KeyInfo keyInfo = new KeyInfo();
            KeyInfoName keyInfoName = new KeyInfoName
            {
                Value = signer.Subject
            };
            keyInfo.AddClause(keyInfoName);               // human readable Principal name

            // Include the public key information (if we are familiar with the algorithm type)
            if (key is RSA)
                keyInfo.AddClause(new RSAKeyValue((RSA)key));    // RSA key parameters
            else
            {
                if (key is DSA)

View on GitHub (pinned to 81131a70a4)