dotnet/wpf · error · SystemException

SR.RightsManagementEncryptionTransformNotFound

Error message

SR.RightsManagementEncryptionTransformNotFound

What it means

Thrown by StorageInfo.CreateStream when a stream is requested with EncryptionOption.RightsManagement but the Rights Management encryption transform label is not defined in the compound file's DataSpaceManager. The library cannot define the RM transform itself because transform initialization requires a publish license and crypto provider, so it assumes EncryptedPackageEnvelope.Create() has already registered it. Hitting this exception means the compound file was not created through the normal EncryptedPackageEnvelope path.

Solutions

Create/open the compound file via EncryptedPackageEnvelope.Create/Open so the RM transform is defined before adding streams
Do not pass EncryptionOption.RightsManagement to CreateStream unless the file is an RM envelope; use CompressionOption and encryption omitted for plain streams
Verify TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName) on Root.GetDataSpaceManager() before attempting to create the encrypted stream
If building the file by hand, define the RM transform with the publish license and crypto provider first, exactly as EncryptedPackageEnvelope.Create does

Example fix

// before
storageInfo.CreateStream("\u0006DataSpaces/TransformInfo", CompressionOption.NotCompressed, EncryptionOption.RightsManagement);
// after
using (var envelope = EncryptedPackageEnvelope.Create(path, publishLicense))
{
    // create streams through the envelope so the RM transform exists
}

Defensive patterns

Strategy: validation

Validate before calling

var manager = root.GetDataSpaceManager();
if (manager == null || !manager.TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName))
    throw new InvalidOperationException("RM transform not defined; open the file through EncryptedPackageEnvelope");

Type guard

bool RmTransformDefined(StorageInfo root) => root.GetDataSpaceManager()?.TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName) == true;

Try / catch

try { storage.CreateStream(name, CompressionOption.NotCompressed, EncryptionOption.RightsManagement); }
catch (SystemException ex) { /* fallback: route through EncryptedPackageEnvelope */ }

Prevention

Always create RM-protected packages through EncryptedPackageEnvelope.Create
Never pass EncryptionOption.RightsManagement on plain (non-envelope) compound files
Validate the dataspace transform labels before writing encrypted streams

When it happens

Trigger: Calling CreateStream with encryptionOption == EncryptionOptionRightsManagement on a compound file whose DataSpaceManager does not have the 'RightsManagementEncryptionTransform' label defined (TransformLabelIsDefined returns false).

Common situations: Manipulating an RM-protected compound file's storages/streams directly via StorageInfo/StreamInfo APIs instead of going through EncryptedPackageEnvelope; opening a file where the RM transform section was stripped or the file was created by another producer without the transform defined.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/14cfe1419e8d342d. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/CompoundFile/StorageInfo.cs:299

        if (manager != null)
        {
            //case : Compression option is set. Stream need to be compressed. Define compression transform.
            //At this time, we only treat CompressionOption - Normal and None. The rest are treated as Normal
            if (compressionOption != CompressionOption.NotCompressed)
            {
                //If it is not defined already, define it.
                if (!manager.TransformLabelIsDefined(sc_compressionTransformName))
                        manager.DefineTransform(CompressionTransform.ClassTransformIdentifier, sc_compressionTransformName);                
            }
             //case : Encryption option is set. Stream need to be encrypted. Define encryption transform.
            if (encryptionOption == EncryptionOption.RightsManagement)
            {
                //If it not defined already, define it.
                if (!manager.TransformLabelIsDefined(EncryptedPackageEnvelope.EncryptionTransformName))
                {
                    //We really cannot define RM transform completely here because the transform initialization cannot be done here without publishlicense and cryptoprovider.
                    //However it will always be defined because this method is accessed only through an EncryptedPackageEnvelope and RM transform is always defined in EncryptedPackageEnvelope.Create()
                    throw new SystemException(SR.RightsManagementEncryptionTransformNotFound);
                }
            }

            //Now find the dataspace label that we need to define these transforms in.
            //CASE: When both CompressionOption and EncryptionOption are set
            if ( (compressionOption != CompressionOption.NotCompressed) && (encryptionOption == EncryptionOption.RightsManagement) )
            {
                dataSpaceLabel = sc_dataspaceLabelRMEncryptionNormalCompression;
                if (!manager.DataSpaceIsDefined(dataSpaceLabel))
                {
                    string[] transformStack = new string[2];
                    //compress the data first. then encrypt it. This ordering will cause the content to be compressed, then encrypted, then written to the stream.
                    transformStack[0] = EncryptedPackageEnvelope.EncryptionTransformName;
                    transformStack[1] = sc_compressionTransformName; 

                    manager.DefineDataSpace(transformStack, dataSpaceLabel);
                }
            }

View on GitHub (pinned to 81131a70a4)