dotnet/wpf · error · NotSupportedException

The stream on which the encrypted package is created must…

Error message

The stream on which the encrypted package is created must have read/write access.

What it means

EncryptedPackageEnvelope wraps an OLE compound-file stream via OpenPackage on the given stream. When constructing on a stream, the underlying root container must be open for FileAccess.ReadWrite because encrypted package creation embeds and writes package data. If the stream was opened read-only, the constructor throws NotSupportedException.

Solutions

1. Open the stream with FileAccess.ReadWrite (e.g. new FileStream(path, FileMode.OpenOrCreate, FileAccess.ReadWrite)) before calling CreateOnStream
2. Check stream.CanWrite and the effective OpenAccess before calling; if read-only, copy to a writable MemoryStream/FileStream first
3. Remove ReadOnly file attributes or fix NTFS/share permissions so the file can be opened read-write

Example fix

// before
using var fs = File.OpenRead("doc.xlsx");
var env = EncryptedPackageEnvelope.CreateOnStream(fs, license, provider); // throws
// after
using var fs = new FileStream("doc.xlsx", FileMode.OpenOrCreate, FileAccess.ReadWrite);
var env = EncryptedPackageEnvelope.CreateOnStream(fs, license, provider);

if (!stream.CanWrite)
    throw new InvalidOperationException("Stream must be writable to create an encrypted package envelope.");

bool IsWritable(Stream s) => s != null && s.CanWrite;

try { var env = EncryptedPackageEnvelope.CreateOnStream(stream, license, provider); }
catch (NotSupportedException ex) { /* stream opened read-only: reopen with FileAccess.ReadWrite */ }

When it happens

Trigger: Calling EncryptedPackageEnvelope.CreateOnStream (or the create constructor taking publishLicense/cryptoProvider) with a Stream whose OpenAccess is FileAccess.Read or Read-only, e.g. a FileStream opened with FileAccess.Read or MemoryStream wrapped read-only.

Common situations: Opening the source file with File.OpenRead/FileStream read-only by habit; passing a stream obtained from a read-only resource such as an embedded assembly resource or downloaded-from-web buffer; share/permission restrictions on Windows forcing read-only access.

Understand the failure class

Background: "is not a compatible type" / "cannot merge" errors: when a value's type doesn't match what the library requires — this error's family across 65 libraries.

Related errors

• Document contains multiple Rights Management Encryption…
• Document does not contain a package.
• Document does not contain any rights management-protected…
• SR.Format(SR.PublishLicenseStreamHeaderTooLong, headerLen…
• SR.PublishLicenseStreamCorrupt

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/0e14a5614bb6e3bc. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/System/IO/Packaging/EncryptedPackage.cs:97

            Stream envelopeStream,
            PublishLicense publishLicense,
            CryptoProvider cryptoProvider
            )
        {
            ArgumentNullException.ThrowIfNull(envelopeStream);

            ThrowIfRMEncryptionInfoInvalid(publishLicense, cryptoProvider);

            _root = StorageRoot.CreateOnStream(envelopeStream, _defaultFileModeForCreate);

            //
            // CreateOnStream opens the stream for read access if it's readable, and for
            // read/write access if it's writable. We're going to need it to be writable,
            // so check that it is.
            //
            if (_root.OpenAccess != FileAccess.ReadWrite)
            {
                throw new NotSupportedException(SR.StreamNeedsReadWriteAccess);
            }

            InitializeRMForCreate(publishLicense, cryptoProvider);
            EmbedPackage(null);
        }

        /// <summary>
        /// Constructor. Create an EncryptedPackageEnvelope on the compound file, using
        /// an existing package as the content.
        /// </summary>
        /// <param name="envelopeFileName">
        /// The path name of the compound file being created to hold the encrypted package.
        /// </param>
        /// <param name="packageStream">
        /// A stream containing an unencrypted package which is to be stored in
        /// the compound file being created in <paramref name="envelopeFileName"/>.
        /// </param>
        /// <param name="publishLicense">

View on GitHub (pinned to 81131a70a4)