dotnet/wpf · error · XmlException

SR.PackageSignatureReferenceTagRequired

Error message

SR.PackageSignatureReferenceTagRequired

What it means

ValidateReferences throws this XmlException when a package-specific reference lacks the required <Transform> canonicalization algorithm tag or otherwise does not carry the mandatory package signature reference tag required by the OPC spec.

Solutions

1. Apply only supported canonicalization transforms (e.g. XML C14N) to package references when creating signatures
2. Strip unsupported transforms before verification, or reject the signature
3. Re-sign the package with compliant transform algorithms

When it happens

Trigger: Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:1203 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/a2b298633dfd7660. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlDigitalSignatureProcessor.cs:1203

                            packageReferenceFound = true;
                    }

                    currentTransformChain = currentReference.TransformChain;

                    for(int j=0; j<currentTransformChain.Count; j++)
                    {
                        //As per the OPC spec, only two transforms are supported for the reference tags
                        if (!IsValidXmlCanonicalizationTransform(currentTransformChain[j].Algorithm))
                            throw new XmlException(SR.UnsupportedTransformAlgorithm);
                    }
                }
                else
                    throw new XmlException(SR.InvalidUriAttribute);
            }

            // If there are zero reference tags or if there wasn't any package specific reference tag            
            if (allowPackageSpecificReferences && !packageReferenceFound)
                throw new XmlException(SR.PackageSignatureReferenceTagRequired);
        }


        //------------------------------------------------------
        //
        //  Private Members
        //
        //------------------------------------------------------
        private PackagePart _signaturePart;
        private X509Certificate2                    _certificate;       // non-null if it's embedded
        private bool                                _lookForEmbeddedCert;
        private PackageDigitalSignatureManager      _manager;
        private PackageDigitalSignature             _signature;         // parsed from part or newly created
        private SignedXml                           _signedXml;         // our format friend
        private String                              _hashAlgorithmName;     // first hash algorithm obtained - considered to be the setting for the entire signature

        // OPC Object tag parsing - once parsed, all fields in this section are considered viable
        private bool                            _dataObjectParsed;          // true if package-specific data Object tag has been parsed

View on GitHub (pinned to 81131a70a4)