# DS322

Source: https://xmlvalid.com/rules/DS322

> Document digest value doesn't match digest calculated value from existing document content. Document content might have changed: the signature states …, the document's digest is … (… with the whitespace between elements).

- Level: error
- Rule sets: MyInvois validations of LHDN (Malaysia) MyInvois SDK of 25 September 2026
- Context: `/*`
- Test: `not($reference) or $stated = ($digest, $minified)`

## Why it fails

- The document was edited after it was signed: an amount, a date or a line added by a later step of the integration.
- The digest was taken over the document as written, not without `ext:UBLExtensions` and `cac:Signature`, or not canonicalized with C14N 1.1.
- The signature block was copied from the SDK's sample, with the sample's digest.

## How to fix it

- Sign as the last step: remove `ext:UBLExtensions` and `cac:Signature`, canonicalize the rest with C14N 1.1, take its SHA-256 in Base64 as the `id-doc-signed-data` reference's DigestValue, and sign that digest.

Validate a document against these rules: https://xmlvalid.com/validate