DocFence 0.48 requires XMLDSIG’s exact Reference shape before a SignedInfo binding can lend static OPC package coverage.
A package binding needs a real Reference
A local URI such as #idPackageObject names an OPC package-specific
Object, but the URI alone is not an XMLDSIG Reference. The SignedInfo
declaration that claims to bind the Object also has a required child order and
transform boundary.
DocFence 0.46 requires the OPC package-specific XMLDSIG object and SignedInfo binding before static package coverage is credited.
DocFence 0.50 rejects OPC’s expressly forbidden MD5 DigestMethod URI before granting bounded package-signature declaration…
DocFence 0.57 requires every OPC Relationship Transform to have its manifest, selector, canonicalization, and relationships-part…
Bibliographies increasingly carry ORCID iDs. LLM drafts also invent them. citesure 0.5.17 treats...
Docker published a guide arguing that SBOMs generated at build time beat post-build scans on completeness, accuracy and…
I spend most of my time building evidence layers for AI agents. The reflex in that work is to reach...
