# XV-SA-01

Source: https://xmlvalid.com/rules/XV-SA-01

> The invoice hash in the signature (DigestValue of the invoiceSignedData reference, …) is not the hash of the invoice (…): the invoice changed after it was signed, or the hash was made over another form of it.

- Level: error
- Rule sets: ZATCA cryptographic stamp and QR code checks Security Features Implementation Standards 1.1, SDK 3.4.6
- Context: `/*[ext:UBLExtensions//ds:Signature]`
- Test: `not($reference) or $stated = $hash`

## Why it fails

- The invoice was edited after it was signed: an amount, a note, the issue time or the PIH.
- The hash was taken over the invoice as written, not without `ext:UBLExtensions`, `cac:Signature` and the QR code's `cac:AdditionalDocumentReference`, or not canonicalized with C14N 1.1.
- The signature block was copied from a sample, with the sample's hash.

## How to fix it

- Sign as the last step: remove the three parts, canonicalize the rest with C14N 1.1, take its SHA-256 in Base64, put it in the `invoiceSignedData` reference and in tag 6 of the QR code, then sign it.

Validate a document against these rules: https://xmlvalid.com/validate