DocFence 0.46 requires the OPC package-specific XMLDSIG object and SignedInfo binding before static package coverage is credited.
A signature declaration needs one home
An OPC package signature can contain several XMLDSIG objects, but only one is
the package-specific object. A static coverage audit should not select any
reachable Manifest and call the result package coverage. It needs to establish
that the declaration is the one OPC structure intended to describe package
DocFence 0.50 rejects OPC’s expressly forbidden MD5 DigestMethod URI before granting bounded package-signature declaration…
DocFence 0.57 requires every OPC Relationship Transform to have its manifest, selector, canonicalization, and relationships-part…
I spend most of my time building evidence layers for AI agents. The reflex in that work is to reach...
Two instructions went into an Auditor my agent collaborators and I built to surface conflicts in...
Inspect Sigstore bundles, DSSE envelopes, SLSA provenance, SD-JWTs and SSH signatures in the browser - each tool runs the…
We build a catalogue of Windows and Android software, and part of the pipeline checks the...
