Container structure

An OSDF package is a constrained ZIP archive with a strict, predictable layout. The constraints exist so that parsing is safe, deterministic, and free of the ambiguities that plague general-purpose archive formats.

Magic header

The file begins with a recognizable magic sequence before the ZIP local header so that content-type detection never depends on the extension alone:

4F 53 44 46 00 04   "OSDF" + format version

Directory layout

document.osdf├── manifest.json          # object table + digests (mandatory)├── meta/│   ├── signatures.json     # signature objects│   └── revisions.json      # hash-linked revision chain├── content/│   └── body.osdfc          # canonical semantic content├── render/│   └── document.pdf        # optional frozen rendition (PDF/A)├── trust/│   ├── chain.json          # credential chain snapshot│   └── proofs.json         # ledger inclusion + consistency proofs└── access/    └── envelope.json       # wrapped DEKs + policy (encrypted profiles)

Constraints

• No ZIP traversal - entries may not contain .., absolute paths, or Unicode path collisions.
• No trailing bytes - there must be no unaccounted data after the central directory.
• Declared sizes - every entry's size and digest must match the manifest.
• Single object table - duplicate entry names are rejected.

A parser that encounters any violation must fail closed.

Continue to Media types.