dotnet/wpf · error · System.InvalidOperationException

SR.UnsupportedTransformAlgorithm

Error message

SR.UnsupportedTransformAlgorithm

What it means

A non-Relationship Transform declared an Algorithm that is not one of the supported XML canonicalization algorithms recognized by XmlDigitalSignatureProcessor.IsValidXmlCanonicalizationTransform. The library throws InvalidOperationException because, per the OPC profile, the only allowed non-Relationship transform is an XML canonicalization method.

Solutions

  1. Change the Transform Algorithm to a supported canonicalization URI (e.g. http://www.w3.org/2001/10/xml-exc-c14n#)
  2. Re-sign the package with PackageDigitalSignatureManager so only supported transforms are written
  3. Remove unsupported transform steps from the signing pipeline and recompute digests accordingly
  4. Confirm the signer and the consuming WPF build agree on the allowed C14N algorithm list

Example fix

// before
<Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116"/>
// after
<Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
Defensive patterns

Strategy: validation

Validate before calling

var supported = new HashSet<string>(StringComparer.Ordinal) {
    "http://www.w3.org/2001/10/xml-exc-c14n#" /* add the full allowed C14N set */ };
const string relNs = "http://schemas.openxmlformats.org/package/2006/RelationshipTransform";
bool allSupported = doc.Descendants(ds + "Transform")
    .Select(t => (string)t.Attribute("Algorithm"))
    .All(a => a == relNs || supported.Contains(a));
if (!allSupported) throw new InvalidDataException("Unsupported transform algorithm");

Try / catch

try
{
    sigManager.VerifySignatures(true);
}
catch (InvalidOperationException ex) when (ex.Message.Contains("transform"))
{
    // unsupported algorithm: re-sign with allowed canonicalization only
}

Prevention

When it happens

Trigger: Verify on a signature whose Transform Algorithm attribute names an unsupported method (e.g. XSLT transforms, base64 decode, exclusive C14N variants not in the allowed set, or custom algorithm URIs).

Common situations: Generic XMLDSig signers using standard-but-non-canonicalization transforms (XSLT, XPath filtering); signer and verifier built against different allowed-algorithm sets; custom enterprise signing pipelines.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/32b0bd1ed777b299. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs:379

                        }
                        else
                            throw new XmlException(SR.MultipleRelationshipTransformsFound);
                    }                    
                    else
                    {
                        // non-Relationship transform should have no children
                        if (reader.IsEmptyElement)
                        {
                            if (transforms == null)
                                transforms = new List<String>();

                            if (XmlDigitalSignatureProcessor.IsValidXmlCanonicalizationTransform(transformName))
                            {
                                transforms.Add(transformName);  // return it
                                continue;   // success
                            }
                            else
                                throw new InvalidOperationException(SR.UnsupportedTransformAlgorithm);
                        }
                    }
                }
                throw new XmlException(SR.XmlSignatureParseError);
            }

            if (transforms.Count == 0)
                throw new XmlException(SR.XmlSignatureParseError);
            
            //If we found another transform after the Relationship transform, it will be validated earlier
            //in this method to make sure that its a supported xml canonicalization algorithm and so we can 
            //simplify this test condition - As per the OPC spec - Relationship transform must be followed
            //by a canonicalization algorithm.
            if (relationshipTransformFound && (transforms.Count == transformsCountWhenRelationshipTransformFound))
                throw new XmlException(SR.RelationshipTransformNotFollowedByCanonicalizationTransform);

            return transforms;
        }

View on GitHub (pinned to 81131a70a4)