Release note · August 6, 2026

A signature reference cannot leave its document

Generic XMLDSIG can describe detached signatures over other resources. OPC package signatures cannot use that flexibility inside SignedInfo: every Reference there must point only within the same Signature element. A parser that inventories package signatures should establish that location boundary before reporting generic XMLDSIG markup as OPC evidence.

Same document means an explicit URI form

ECMA-376 Open Packaging Conventions §10.5.7.2 requires SignedInfo References to reference elements only in the same Signature. XMLDSIG defines its same-document URI forms as either an empty URI or a URI beginning with a fragment:

<Reference URI="">…</Reference>
<Reference URI="#idPackageObject">…</Reference>

Those forms identify the XML document that contains the Signature or an element in it. In contrast, a missing URI leaves object identity to application context, and a package-relative or absolute URI names something outside that XML Signature document.

What DocFence 0.52 rejects

Every direct SignedInfo/Reference must now carry either the explicit empty URI or a nonempty local fragment beginning with #. An omitted URI, a package path such as /word/document.xml, or an absolute URI fails the recognized XML-signature shape closed.

This runs before package-signature inventory and static declaration coverage. It prevents a foreign detached-signature model from borrowing OPC-looking relationships and content types; it does not change the meaning of a valid coverage declaration or turn DFP092 and DFP093 into signature verification.

No URI is followed

DocFence does not dereference a URI, resolve a fragment or XPointer, perform canonicalization, evaluate transforms, recompute a digest, verify XMLDSIG, inspect certificates, establish trust, or predict an Office client. The rule classifies only the stored URI location syntax. Public reports still withhold reference URIs, selectors, paths, digest material, and document contents.

version: 1
rules:
  require_complete_package_signature_coverage: true
  no_package_signature_coverage_changes: true

Evidence and compatibility

The 69-test suite covers both accepted forms—an empty URI and a local fragment—plus missing, package-relative, and absolute URIs. The public OOXML Signature Security artifacts contain 29 DOCX fixtures. Compared with 0.51, exactly one profile changes: a published universal-signature-forgery attacker package has eight ODF-style package-file References in SignedInfo and now fails structurally rather than being inventoried as an OPC signature. The other 28 profiles are unchanged.

Main and tagged CI passed. Fresh wheel and source-distribution installations accept a valid signed OPC baseline and reject that real foreign-reference fixture. The public GitHub release downloads were byte-compared with the reproducible build.

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.52.0/docfence-0.52.0-py3-none-any.whl

docfence check approved.docx candidate.docx --policy docfence.yml --format sarif --output docfence.sarif

The tagged policy reference, threat model, and validation notes define the boundary. A structural scanner is most useful when it can say exactly where stored package syntax stops supporting the claim it is being asked to inventory.