What causes "SR.XmlSignatureParseError" in dotnet/wpf?

Ensure the signature XML's is in the http://www.w3.org/2000/09/xmldsig# namespace and sits as a direct child of (depth 3)

dotnet/wpf · error · XmlException

SR.XmlSignatureParseError

Error message

SR.XmlSignatureParseError

What it means

System.IO.Packaging throws this XmlException when the <DigestMethod> element inside a signature's <Reference> fails structural validation: it carries non-xmlns attributes beyond the Algorithm attribute, is not in the XMLDSig namespace (http://www.w3.org/2000/09/xmldsig#), or appears at the wrong XML depth (must be depth 3). The manifest parser rejects the signature XML as malformed.

Solutions

Ensure the signature XML's <DigestMethod> is in the http://www.w3.org/2000/09/xmldsig# namespace and sits as a direct child of <Reference> (depth 3)
Remove any non-xmlns attributes other than Algorithm from the <DigestMethod> element
Re-sign the package with PackageDigitalSignatureManager instead of hand-generating or post-processing the signature XML
If a third-party tool produced the signature, configure or replace the tool so it emits standards-compliant XMLDSig

Example fix

// before
// <DigestMethod xmlns="http://custom.example/ns" Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" Extra="x"/>
// after
// <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> (inherited xmldsig namespace)

Defensive patterns

Strategy: validation

Validate before calling

var doc = XDocument.Load(signaturePartStream);
XNamespace ds = "http://www.w3.org/2000/09/xmldsig#";
bool ok = doc.Descendants(ds + "DigestMethod")
    .All(dm => dm.Parent?.Name == ds + "Reference"
        && dm.Attributes().Count(a => !a.IsNamespaceDeclaration) == 1
        && dm.Attribute("Algorithm") != null);
if (!ok) throw new InvalidDataException("DigestMethod element is non-conformant");

Try / catch

try { var sigUri = ParseSignature(xmlStream); }
catch (XmlException ex) when (ex.Message.Contains("XmlSignatureParseError"))
{
    // reject the signature XML as malformed
}

Prevention

Keep DigestMethod in the default xmldsig namespace with only an Algorithm attribute
Avoid XML round-trips that re-declare namespaces or add attributes to signature elements
Use standards-compliant signing tools

When it happens

Trigger: ParseReference -> ParseDigestAlgorithmTag encounters a <DigestMethod> whose NamespaceURI differs from SignedXml.XmlDsigNamespaceUrl, whose depth is not 3, or with more than one non-xmlns attribute (GetNonXmlnsAttributeCount > 1).

Common situations: Signatures produced by tools that emit DigestMethod in a custom namespace or with extra custom attributes; wrappers re-serialize the signature XML and nest the element at the wrong level; namespaces re-declared or prefixed incorrectly during round-tripping of the package.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/4e28f969ea2ba1d5. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/XmlSignatureManifest.cs:159

                    throw new XmlException(SR.Format(SR.UnexpectedXmlTag, reader.Name));
            }

            // XmlDSig xsd requires at least one <Reference> tag
            if (referenceCount == 0)
                throw new XmlException(SR.PackageSignatureCorruption);
        }

        /// <summary>
        /// Parse the DigestMethod tag
        /// </summary>
        /// <param name="reader"></param>
        private static string ParseDigestAlgorithmTag(XmlReader reader)
        {
            // verify namespace and lack of attributes
            if (PackagingUtilities.GetNonXmlnsAttributeCount(reader) > 1
                || !string.Equals(reader.NamespaceURI, SignedXml.XmlDsigNamespaceUrl, StringComparison.Ordinal)
                || reader.Depth != 3)
                throw new XmlException(SR.XmlSignatureParseError);

            // get the Algorithm attribute
            string hashAlgorithm = null;
            if (reader.HasAttributes)
            {
                hashAlgorithm = reader.GetAttribute(XTable.Get(XTable.ID.AlgorithmAttrName));
            }

            if (hashAlgorithm == null || hashAlgorithm.Length == 0)
                throw new XmlException(SR.UnsupportedHashAlgorithm);

            return hashAlgorithm;
        }

        /// <summary>
        /// Parse the DigestValue tag
        /// </summary>
        /// <param name="reader"></param>

View on GitHub (pinned to 81131a70a4)