What this OpenDocument inspector checks
The audit reads the ZIP central directory and every supported entry, compares local and central metadata, bounds compressed data, expands stored or deflated content, and recalculates CRC32. It then checks the OpenDocument mimetype entry, including its first-position, uncompressed-storage, and no-local-extra-field rules, and compares that media type with the filename and manifest root declaration.
Manifest, XML, and link checks
META-INF/manifest.xml is parsed as XML and its file entries are reconciled with package members. Core XML parts are checked for balanced tags, quoted and unique attributes, UTF-8, and bounded structure. xlink:href and other href values are inventoried: relative package targets are normalized and checked for a matching entry, unsafe traversal is rejected, and external URLs remain visible without being requested.
Encryption, signatures, macros, and metadata
Manifest encryption declarations, signature files, Basic or Scripts entries, and selected metadata such as creator, dates, title, and generator are surfaced for review. These are presence checks. The page never runs macros, decrypts content, verifies a digital signature, decides whether code is safe, or proves that sensitive information is absent.
Validation boundary
A clean package audit does not prove ODF conformance or visual fidelity. This tool does not apply the full RELAX NG schemas, validate every ODF semantic rule, resolve RDF, render pages or sheets, inspect embedded binary formats, verify signatures, repair ZIP data, or predict LibreOffice, Microsoft Office, or repository behavior. Use an ODF schema validator and the destination application for release decisions. Flat XML OpenDocument files and ZIP64 packages are outside this bounded workflow.
Frequently asked questions
Why must mimetype be first and uncompressed?
The ODF package rules give software a fast, stable way to identify the document without scanning or inflating the archive. This page checks the actual local ZIP record rather than trusting the extension.
Does this open encrypted ODF files?
No. It identifies manifest entries that declare encryption. Decryption would require credentials and broader algorithm support, and it would change the privacy and security boundary of this read-only preflight.
Does a CRC pass mean the document is safe?
No. CRC32 detects accidental byte corruption; it is not authentication and says nothing about macros, links, exploitability, meaning, or provenance.
Are external links contacted?
No. Their literal targets are displayed so you can review them, but the page makes no request to those locations.
Authoritative format references
The package checks follow the OASIS OpenDocument 1.4 Part 2: Packages. Document structure and media-type context are defined by the broader OpenDocument 1.4 specification. Use official schemas and application-specific validation for complete conformance work.
Validate a BagIt package · Inspect an OLE/CFB container · Browse digital-preservation tools