DocFence 0.50 rejects OPC’s expressly forbidden MD5 DigestMethod URI before granting bounded package-signature declaration coverage.
A digest method has one hard stop
Static package-signature coverage is not cryptographic verification, but it
still has to respect the standard's hard syntax boundaries. OPC makes a useful
distinction for DigestMethod: SHA-2 values are recommended, SHA-1
is discouraged, and one URI—MD5—is expressly forbidden. A structure-only
DocFence 0.46 requires the OPC package-specific XMLDSIG object and SignedInfo binding before static package coverage is credited.
My Content Security Policy allows scripts by exact hash and nothing else. That works right up until a Markdown plugin decides to…
Two weeks ago I published the first piece of this series: the official MCP filesystem server — 228...
DocFence 0.57 requires every OPC Relationship Transform to have its manifest, selector, canonicalization, and relationships-part…
If you've built an MCP server, you know the drill: define a tool, write a handler, return a result....
A capability-compiler meets ten deliberately-broken MCP servers. The honest scorecard: it cleanly stops one class, contains…
