How can I use an XML detached signature when the file may be stored anywhere? How can I use an XML detached digital signature in Java when the URI where the file is being signed will not be the same as when the file is being validated? Specifically, the file to be signed is created and signed on one server, then shipped to another server where it should be verified. The URI is file:///....
Similar to RFC 5485, the need is for the file to be signed "to be stored anywhere without hindering signature validation". Unlike RFC 5485, the need is for an XML formatted detached signature. The Java implementation seems to require the full URI to be the same at the signing time and at the validation time.
You do not need to include a URI in the Reference element of a detached signature. Just include the signature algorithm and the digest value, then you can associate signature and file by yourself.