diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d57e04371..806165598 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -125,6 +125,7 @@ jobs:
   fedora:
     name: Build on Fedora ${{ matrix.container }}
     runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.container == 'rawhide' }}
     container: fedora:${{ matrix.container }}
     strategy:
       matrix:
@@ -231,11 +232,14 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v6
-    - name: Cache vcpkg
+    - name: Cache vcpkg and WiX
       uses: actions/cache@v5
       with:
-        path: ${{ github.workspace }}/vcpkg_cache
-        key: vcpkg-${{ matrix.toolset }}-${{ matrix.platform }}-${{ hashFiles('vcpkg.json') }}
+        path: |
+          ${{ github.workspace }}/vcpkg_cache
+          ~/.dotnet/tools
+          ~/.wix
+        key: vcpkg-${{ matrix.toolset }}-${{ matrix.platform }}-${{ hashFiles('vcpkg.json') }}-wix-7.0.0
     - name: Setup winget
       if: matrix.toolset == '143'
       shell: powershell
@@ -269,7 +273,8 @@ jobs:
           -swig $swig `
           -doxygen "C:/Program files/doxygen/bin/doxygen.exe" `
           -boost `
-          -python ${{ github.workspace }}/python
+          -python ${{ github.workspace }}/python `
+          -acceptWixEULA
     - name: Archive artifacts
       uses: actions/upload-artifact@v7
       with:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 119083633..3f6d29a84 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -5,7 +5,7 @@ endif()
 if(POLICY CMP0177)
     cmake_policy(SET CMP0177 NEW)
 endif()
-project(libdigidocpp VERSION 4.5.1
+project(libdigidocpp VERSION 4.6.0
     DESCRIPTION "C++ library for digital signatures and validation of digitally signed documents"
     HOMEPAGE_URL https://github.com/open-eid/libdigidocpp
 )
diff --git a/README.md b/README.md
index ab4ebf01c..02e2f56a0 100644
--- a/README.md
+++ b/README.md
@@ -139,13 +139,19 @@
 
 6. Alternative to steps 4. and 5. -
 
-        powershell -ExecutionPolicy ByPass -File build.ps1
+        powershell -ExecutionPolicy ByPass -File build.ps1 -acceptWixEULA
+
+    WiX 7 requires accepting its
+    [Open Source Maintenance Fee EULA](https://docs.firegiant.com/wix/osmf/).
+    Pass `-acceptWixEULA` only after reviewing the terms. The acceptance is stored
+    for the current user, so the switch can be omitted from subsequent builds.
 
     Optional build.ps1 parameters:
 
         -swig C:/swigwin-4.4.1/swig.exe
         -doxygen "C:/Program files/doxygen/bin/doxygen.exe"
         -boost
+        -acceptWixEULA
 
     The build script builds executables and installation media for given
     platform (Debug and Release with debug symbols)
diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md
index 22edd9e8c..2adad3f1b 100644
--- a/RELEASE-NOTES.md
+++ b/RELEASE-NOTES.md
@@ -9,7 +9,7 @@ Libdigidocpp library [4.5.0](https://github.com/open-eid/libdigidocpp/releases/t
 - Harden XML, ZIP, network, and file handling
   (#731, #732, #734, #736, #738, #743)
 - Other fixes, optimizations, and documentation updates
-  (#727, #733, #753, #755)
+  (#727, #733, #753, #755, #757)
 
 [Full Changelog](https://github.com/open-eid/libdigidocpp/compare/v4.4.0...v4.5.0)
 
diff --git a/build.ps1 b/build.ps1
index f210fe03c..9e7f79ad2 100644
--- a/build.ps1
+++ b/build.ps1
@@ -1,7 +1,7 @@
 #powershell -ExecutionPolicy ByPass -File build.ps1
 param(
   [string]$libdigidocpp = $PSScriptRoot,
-  [string]$platform = $env:PLATFORM,
+  [string]$platform = $(if ($null -eq $env:PLATFORM) {"x64"} else {$env:PLATFORM}),
   [string]$build_number = $(if ($null -eq $env:BUILD_NUMBER) {"0"} else {$env:BUILD_NUMBER}),
   [string]$msiversion = (Select-String -Path "$libdigidocpp/CMakeLists.txt" -Pattern 'project\(\w+ VERSION (\S+)').Matches[0].Groups[1].Value + ".$build_number",
   [string]$msi_name = "libdigidocpp-$msiversion$env:VER_SUFFIX.$platform.msi",
@@ -16,7 +16,8 @@ param(
   [string]$doxygen = $null,
   [switch]$boost = $false,
   [string]$sign = $null,
-  [string]$python = $null
+  [string]$python = $null,
+  [switch]$acceptWixEULA = $false
 )
 
 $ErrorActionPreference = "Stop"
@@ -25,10 +26,14 @@ Try {
   & wix > $null
 }
 Catch {
-  & dotnet tool install -g --version 6.0.2 wix
-  & wix extension add -g WixToolset.UI.wixext/6.0.2
+  & dotnet tool install -g --version 7.0.0 wix
 }
 
+if($acceptWixEULA) {
+  & wix eula accept wix7
+}
+& wix extension add -g WixToolset.UI.wixext/7.0.0
+
 if(!(Test-Path -Path $vcpkg)) {
   $vcpkg = "$libdigidocpp\vcpkg"
   & $git clone https://github.com/microsoft/vcpkg $vcpkg
diff --git a/libdigidocpp.wxs b/libdigidocpp.wxs
index a5c9e9d75..e8aeda386 100644
--- a/libdigidocpp.wxs
+++ b/libdigidocpp.wxs
@@ -16,8 +16,6 @@
 <?define VCVER = "145" ?>
 <?elseif $(env.VisualStudioVersion) = "17.0" ?>
 <?define VCVER = "143" ?>
-<?elseif $(env.VisualStudioVersion) = "16.0" ?>
-<?define VCVER = "142" ?>
 <?endif?>
 
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
diff --git a/src/ASiC_S.cpp b/src/ASiC_S.cpp
index 1ad6cbb30..2ca3af023 100644
--- a/src/ASiC_S.cpp
+++ b/src/ASiC_S.cpp
@@ -19,6 +19,9 @@
 
 #include "ASiC_S.h"
 
+#include "DataFile_p.h"
+#include "Exception.h"
+#include "SiVaContainer.h"
 #include "SignatureTST.h"
 #include "SignatureXAdES_LTA.h"
 #include "crypto/Signer.h"
@@ -33,7 +36,7 @@ using namespace std;
 /**
  * Initialize ASiCS container.
  */
-ASiC_S::ASiC_S(const string &path, bool create)
+ASiC_S::ASiC_S(const string &path, bool create, ContainerOpenCB *cb)
     : ASiContainer(path, MIMETYPE_ASIC_S)
 {
     if(create)
@@ -49,14 +52,14 @@ ASiC_S::ASiC_S(const string &path, bool create)
             foundTimestamp = true;
         if(file == "META-INF/ASiCArchiveManifest.xml")
         {
-            if(!signatures().empty())
+            if(!containerSignatures().empty())
                 THROW("Can not add signature to ASiC-S container which already contains a signature.");
             addSignature(make_unique<SignatureTST>(true, z, this));
             foundManifest = true;
         }
         else if(file == "META-INF/signatures.xml")
         {
-            if(!signatures().empty())
+            if(!containerSignatures().empty())
                 THROW("Can not add signature to ASiC-S container which already contains a signature.");
             auto signatures = make_shared<Signatures>(XMLDocument::open(z.read(file)), mediaType());
             for(auto s = signatures->signature(); s; s++)
@@ -67,31 +70,78 @@ ASiC_S::ASiC_S(const string &path, bool create)
         else if(const auto directory = File::directory(file);
             !directory.empty() && directory != "/" && directory != "./")
             THROW("Subfolders are not supported %s", directory.c_str());
-        else if(!dataFiles().empty())
+        else if(!containerDataFiles().empty())
             THROW("Can not add document to ASiC-S container which already contains a document.");
         else
             addDataFilePrivate(z, file, "application/octet-stream");
     }
     if(foundTimestamp && !foundManifest)
     {
-        if(!signatures().empty())
+        if(!containerSignatures().empty())
             THROW("Can not add signature to ASiC-S container which already contains a signature.");
         addSignature(make_unique<SignatureTST>(false, z, this));
     }
 
-    if(dataFiles().empty())
+    if(containerDataFiles().empty())
         THROW("ASiC-S container does not contain any data objects.");
-    if(signatures().empty())
+    if(containerSignatures().empty())
         THROW("ASiC-S container does not contain any signatures.");
+
+    const auto documents = containerDataFiles();
+    const auto containerSigs = containerSignatures();
+    if(!cb || documents.size() != 1 || containerSigs.size() != 1 ||
+        containerSigs.front()->profile() != ASIC_TST_PROFILE ||
+        !File::fileExtension(documents.front()->fileName(), {"ddoc"}))
+        return;
+
+    try
+    {
+        auto *ddoc = static_cast<DataFilePrivate*>(documents.front());
+        enclosedDDoc = SiVaContainer::openDDoc(*ddoc->m_is, ddoc->fileName(), cb);
+    }
+    catch(...) {}
 }
 
 void ASiC_S::addDataFileChecks(string_view fileName, const string &mediaType)
 {
     ASiContainer::addDataFileChecks(fileName, mediaType);
-    if(!dataFiles().empty())
+    if(!containerDataFiles().empty())
         THROW("Can not add document to ASiC-S container which already contains a document.");
 }
 
+vector<DataFile*> ASiC_S::containerDataFiles() const
+{
+    return ASiContainer::dataFiles();
+}
+
+vector<DataFile*> ASiC_S::dataFiles() const
+{
+    return enclosedDDoc ? enclosedDDoc->dataFiles() : containerDataFiles();
+}
+
+vector<Signature*> ASiC_S::containerSignatures() const
+{
+    return ASiContainer::signatures();
+}
+
+void ASiC_S::removeSignature(unsigned int id)
+{
+    if(enclosedDDoc)
+        THROW("Can not remove signatures from an ASiC-S container with an enclosed DDoc.");
+    ASiContainer::removeSignature(id);
+}
+
+vector<Signature*> ASiC_S::signatures() const
+{
+    auto result = containerSignatures();
+    if(enclosedDDoc)
+    {
+        auto enclosed = enclosedDDoc->signatures();
+        result.insert(result.end(), enclosed.begin(), enclosed.end());
+    }
+    return result;
+}
+
 unique_ptr<Container> ASiC_S::createInternal(const string &path)
 {
     if(!util::File::fileExtension(path, {"asics", "scs"}))
@@ -107,18 +157,18 @@ void ASiC_S::addAdESSignature(istream & /*signature*/)
 
 void ASiC_S::canSave()
 {
-    if(auto list = signatures(); !list.empty() && list.front()->profile() != ASIC_TST_PROFILE)
+    if(auto list = containerSignatures(); !list.empty() && list.front()->profile() != ASIC_TST_PROFILE)
         THROW("ASiC-S container supports only saving TimeStampToken signatures.");
 }
 
-unique_ptr<Container> ASiC_S::openInternal(const string &path, ContainerOpenCB * /*cb*/)
+unique_ptr<Container> ASiC_S::openInternal(const string &path, ContainerOpenCB *cb)
 {
     DEBUG("ASiC_S::openInternal(%s)", path.c_str());
     try
     {
         if(util::File::fileExtension(path, {"asice", "sce", "bdoc"}))
             return {};
-        return unique_ptr<Container>(new ASiC_S(path, false));
+        return unique_ptr<Container>(new ASiC_S(path, false, cb));
     }
     catch(const Exception &)
     {
@@ -137,7 +187,7 @@ void ASiC_S::save(const ZipSerialize &s)
     if(const auto &prop = zproperty("META-INF/manifest.xml");
         prop.size && !createManifest().save(s.addFile("META-INF/manifest.xml", prop), true))
         THROW("Failed to create manifest XML");
-    for(Signature *sig: signatures())
+    for(Signature *sig: containerSignatures())
         static_cast<SignatureTST*>(sig)->save(s);
 }
 
@@ -145,7 +195,7 @@ Signature *ASiC_S::sign(Signer *signer)
 {
     if(signer->profile() != ASIC_TST_PROFILE)
         THROW("ASiC-S container supports only TimeStampToken signing.");
-    if(!signatures().empty())
+    if(!containerSignatures().empty())
         THROW("ASiC-S container supports only one TimeStampToken signature.");
     return addSignature(make_unique<SignatureTST>(this, signer));
 }
diff --git a/src/ASiC_S.h b/src/ASiC_S.h
index bfccbe053..b9946dd34 100644
--- a/src/ASiC_S.h
+++ b/src/ASiC_S.h
@@ -36,20 +36,27 @@ namespace digidoc
         static constexpr std::string_view ASIC_TST_PROFILE = "TimeStampToken";
 
         void addAdESSignature(std::istream &sigdata) override;
+        std::vector<DataFile*> dataFiles() const override;
         Signature* prepareSignature(Signer *signer) override;
+        void removeSignature(unsigned int id) override;
+        std::vector<Signature*> signatures() const override;
         Signature* sign(Signer* signer) override;
 
         static std::unique_ptr<Container> createInternal(const std::string &path);
         static std::unique_ptr<Container> openInternal(const std::string &path, ContainerOpenCB *cb);
 
     private:
-        ASiC_S(const std::string &path, bool create);
+        ASiC_S(const std::string &path, bool create, ContainerOpenCB *cb = nullptr);
         DISABLE_COPY(ASiC_S);
 
         void addDataFileChecks(std::string_view path, const std::string &mediaType) override;
         void canSave() final;
+        std::vector<DataFile*> containerDataFiles() const;
+        std::vector<Signature*> containerSignatures() const;
         void save(const ZipSerialize &s) final;
 
+        std::unique_ptr<Container> enclosedDDoc;
+
         friend class SignatureTST;
     };
 }
diff --git a/src/ASiContainer.cpp b/src/ASiContainer.cpp
index dc7d7f5bb..37358772c 100644
--- a/src/ASiContainer.cpp
+++ b/src/ASiContainer.cpp
@@ -62,7 +62,7 @@ XMLDocument ASiContainer::createManifest() const
         file.setProperty("media-type", mime, MANIFEST_NS);
     };
     add("/", mediaType());
-    for(const DataFile *file: dataFiles())
+    for(const DataFile *file: d->documents)
         add(file->fileName(), file->mediaType());
     return doc;
 }
@@ -265,7 +265,7 @@ void ASiContainer::deleteSignature(Signature* s)
 
 void ASiContainer::save(const string &path)
 {
-    if(dataFiles().empty())
+    if(d->documents.empty())
         THROW("Can not save, container is empty.");
     canSave();
     if(!path.empty())
@@ -274,7 +274,7 @@ void ASiContainer::save(const string &path)
     s.addFile("mimetype", zproperty("mimetype"), false)(mediaType());
 
     array<char,10240> buf{};
-    for(const DataFile *file: dataFiles())
+    for(const DataFile *file: d->documents)
     {
         auto f = s.addFile(file->fileName(), zproperty(file->fileName()));
         const auto &is = static_cast<const DataFilePrivate*>(file)->m_is;
diff --git a/src/Container.cpp b/src/Container.cpp
index 30635f1a2..c4a95d394 100644
--- a/src/Container.cpp
+++ b/src/Container.cpp
@@ -345,7 +345,11 @@ unique_ptr<Container> Container::createPtr(const std::string &path)
 std::unique_ptr<Container> Container::extendContainerValidity(Container &doc, Signer *signer, size_t &extendedCount) try
 {
     extendedCount = 0;
-    if(doc.signatures().empty())
+    auto signatures = doc.signatures();
+    if(doc.mediaType() == ASiContainer::MIMETYPE_ASIC_S &&
+        !signatures.empty() && signatures.front()->profile() == ASiC_S::ASIC_TST_PROFILE)
+        signatures.resize(1);
+    if(signatures.empty())
         THROW("Container does not contain signatures");
 
     if(doc.mediaType() == ASiContainer::MIMETYPE_ASIC_S ||
@@ -354,7 +358,7 @@ std::unique_ptr<Container> Container::extendContainerValidity(Container &doc, Si
         bool extendInPlace = true;
         size_t tCount = 0;
         size_t eeCount = 0;
-        for(Signature *s: doc.signatures())
+        for(Signature *s: signatures)
         {
             auto signingCert = s->signingCertificate();
             if(signingCert.subjectName("C") != "EE" ||
@@ -431,7 +435,7 @@ std::unique_ptr<Container> Container::extendContainerValidity(Container &doc, Si
 
         if(extendInPlace)
         {
-            for(Signature *s: doc.signatures())
+            for(Signature *s: signatures)
             {
                 if(auto cert = s->signingCertificate();
                     cert.subjectName("C") != "EE" ||
diff --git a/src/SiVaContainer.cpp b/src/SiVaContainer.cpp
index 289eddd90..2f0b847e5 100644
--- a/src/SiVaContainer.cpp
+++ b/src/SiVaContainer.cpp
@@ -30,6 +30,7 @@
 #include "XMLDocument.h"
 #include "crypto/Connect.h"
 #include "crypto/TS.h"
+#include "util/algorithm.h"
 #include "util/DateTime.h"
 #include "util/File.h"
 
@@ -43,9 +44,14 @@ using namespace digidoc::util;
 using namespace std;
 using json = nlohmann::json;
 
-class SiVaContainer::Private
+namespace
+{
+struct RetryWithoutHashCode {};
+struct UnknownFile {};
+}
+
+struct SiVaContainer::Private
 {
-public:
     std::filesystem::path path;
     string  mediaType;
     vector<DataFile*> dataFiles;
@@ -69,7 +75,7 @@ void SignatureSiVa::validate() const
 
 void SignatureSiVa::validate(const string &policy) const
 {
-    static const set<string_view> QES = { "QESIG", "QES", "QESEAL",
+    constexpr array QES { "QESIG", "QES", "QESEAL",
         "ADESEAL_QC", "ADESEAL" }; // Special treamtent for E-Seals
     Exception e(EXCEPTION_PARAMS("Signature validation"));
     try {
@@ -85,7 +91,7 @@ void SignatureSiVa::validate(const string &policy) const
         if(_indication == "TOTAL-PASSED")
         {
             // DDoc returns _signatureLevel empty
-            if(policy == POLv2 && !_signatureLevel.empty() && !QES.contains(_signatureLevel))
+            if(policy == POLv2 && !_signatureLevel.empty() && !contains(QES, _signatureLevel))
             {
                 Exception ex(EXCEPTION_PARAMS("Signing certificate does not meet Qualification requirements"));
                 ex.setCode(Exception::CertificateIssuerMissing);
@@ -111,8 +117,7 @@ SiVaContainer::SiVaContainer(const string &path, ContainerOpenCB *cb, bool useHa
     istream *is = ifs.get();
     if(File::fileExtension(path, {"ddoc"}))
     {
-        d->mediaType = "application/x-ddoc";
-        ifs = parseDDoc(ifs, useHashCode);
+        ifs = parseDDoc(*ifs, useHashCode);
         is = ifs.get();
     }
     else if(File::fileExtension(path, {"pdf"}))
@@ -125,12 +130,12 @@ SiVaContainer::SiVaContainer(const string &path, ContainerOpenCB *cb, bool useHa
         ZipSerialize z(path, false);
         if(d->mediaType = z.mimetype();
             d->mediaType != ASiContainer::MIMETYPE_ASIC_E && d->mediaType != ASiContainer::MIMETYPE_ASIC_S)
-            THROW("Unknown file");
+            throw UnknownFile {};
         vector<string> list = z.list();
         if(none_of(list.cbegin(), list.cend(), [](const string &file) {
                 return file.starts_with("META-INF/") && util::File::fileExtension(file, {"p7s"});
             }))
-            THROW("Unknown file");
+            throw UnknownFile {};
 
         for(const string &file: list)
         {
@@ -142,27 +147,39 @@ SiVaContainer::SiVaContainer(const string &path, ContainerOpenCB *cb, bool useHa
         }
     }
     else
-        THROW("Unknown file");
+        throw UnknownFile {};
+
+    validate(*is, string(fileName), cb, useHashCode);
+}
+
+SiVaContainer::SiVaContainer(istream &ddoc, const string &fileName, ContainerOpenCB *cb, bool useHashCode)
+    : d(make_unique<Private>())
+{
+    DEBUG("SiVaContainer::SiVaContainer(%s, %d)", fileName.c_str(), useHashCode);
+    auto document = parseDDoc(ddoc, useHashCode);
+    validate(*document, fileName, cb, useHashCode);
+}
 
+void SiVaContainer::validate(istream &document, const string &fileName, ContainerOpenCB *cb, bool useHashCode)
+{
     if(useHashCode && cb && !cb->validateOnline())
         THROW("Online validation disabled");
 
     array<unsigned char, 4800> buf{};
     string b64;
-    is->clear();
-    is->seekg(0);
-    while(*is)
+    document.clear();
+    document.seekg(0);
+    while(document)
     {
-        is->read((char*)buf.data(), buf.size());
-        if(is->gcount() <= 0)
+        document.read((char*)buf.data(), buf.size());
+        if(document.gcount() <= 0)
             break;
 
         size_t pos = b64.size();
         b64.resize(b64.size() + ((buf.size() + 2) / 3) * 4);
-        int size = EVP_EncodeBlock((unsigned char*)&b64[pos], buf.data(), int(is->gcount()));
+        int size = EVP_EncodeBlock((unsigned char*)&b64[pos], buf.data(), int(document.gcount()));
         b64.resize(pos + size);
     }
-    ifs.reset();
 
     string req = json({
         {"filename", fileName},
@@ -238,7 +255,7 @@ SiVaContainer::SiVaContainer(const string &path, ContainerOpenCB *cb, bool useHa
         {
             string message = error["content"];
             if(message.find("Bad digest for DataFile", 0) != string::npos && useHashCode)
-                THROW("%s", message.c_str());
+                throw RetryWithoutHashCode {};
             s->_exceptions.emplace_back(EXCEPTION_PARAMS("%s", message.c_str()));
         }
         for(const json &warning: signature.value<json>("warnings", {}))
@@ -298,20 +315,33 @@ unique_ptr<Container> SiVaContainer::openInternal(const string &path, ContainerO
 {
     try {
         return unique_ptr<Container>(new SiVaContainer(path, cb, true));
-    } catch(const Exception &e) {
-        if(e.msg().find("Bad digest for DataFile") != string::npos)
-            return unique_ptr<Container>(new SiVaContainer(path, cb, false));
-        if(e.msg() == "Unknown file")
-            return {};
-        throw;
+    } catch(const RetryWithoutHashCode &) {
+        return unique_ptr<Container>(new SiVaContainer(path, cb, false));
+    } catch(const UnknownFile &) {
+        return {};
     }
 }
 
-unique_ptr<istream> SiVaContainer::parseDDoc(const unique_ptr<istream> &ddoc, bool useHashCode)
+unique_ptr<Container> SiVaContainer::openDDoc(istream &ddoc, const string &fileName, ContainerOpenCB *cb)
+{
+    auto open = [&](bool useHashCode) -> unique_ptr<Container> {
+        ddoc.clear();
+        ddoc.seekg(0);
+        return unique_ptr<Container>(new SiVaContainer(ddoc, fileName, cb, useHashCode));
+    };
+    try {
+        return open(true);
+    } catch(const RetryWithoutHashCode &) {
+        return open(false);
+    }
+}
+
+unique_ptr<istream> SiVaContainer::parseDDoc(istream &ddoc, bool useHashCode)
 {
     try
     {
-        auto doc = XMLDocument::openStream(*ddoc, {}, true);
+        d->mediaType = "application/x-ddoc";
+        auto doc = XMLDocument::openStream(ddoc, {}, true);
         for(auto dataFile = doc/"DataFile"; dataFile; dataFile++)
         {
             auto contentType = dataFile["ContentType"];
@@ -349,8 +379,7 @@ unique_ptr<istream> SiVaContainer::parseDDoc(const unique_ptr<istream> &ddoc, bo
 
 string SiVaContainer::path() const
 {
-    auto name = d->path.u8string();
-    return {reinterpret_cast<const char*>(name.data()), name.size()};
+    return File::decodeName(d->path);
 }
 
 Signature* SiVaContainer::prepareSignature(Signer * /*signer*/)
diff --git a/src/SiVaContainer.h b/src/SiVaContainer.h
index 3c00eb633..24c425893 100644
--- a/src/SiVaContainer.h
+++ b/src/SiVaContainer.h
@@ -100,16 +100,20 @@ class SiVaContainer final: public Container
     Signature* sign(Signer* signer) final;
 
     static std::unique_ptr<Container> createInternal(const std::string &path);
+    static std::unique_ptr<Container> openDDoc(std::istream &ddoc,
+        const std::string &fileName, ContainerOpenCB *cb);
     static std::unique_ptr<Container> openInternal(const std::string &path, ContainerOpenCB *cb);
 
 private:
     std::string path() const final;
     SiVaContainer(const std::string &path, ContainerOpenCB *cb, bool useHashCode);
+    SiVaContainer(std::istream &ddoc, const std::string &fileName, ContainerOpenCB *cb, bool useHashCode);
     DISABLE_COPY(SiVaContainer);
 
-    std::unique_ptr<std::istream> parseDDoc(const std::unique_ptr<std::istream> &ddoc, bool useHashCode);
+    std::unique_ptr<std::istream> parseDDoc(std::istream &ddoc, bool useHashCode);
+    void validate(std::istream &document, const std::string &fileName, ContainerOpenCB *cb, bool useHashCode);
 
-    class Private;
+    struct Private;
     std::unique_ptr<Private> d;
 };
 
diff --git a/src/SignatureTST.cpp b/src/SignatureTST.cpp
index b6207cb80..2e85f7b2c 100644
--- a/src/SignatureTST.cpp
+++ b/src/SignatureTST.cpp
@@ -103,7 +103,7 @@ SignatureTST::SignatureTST(bool manifest, const ZipSerialize &z, ASiC_S *asicSDo
 SignatureTST::SignatureTST(ASiC_S *asicSDoc, Signer *signer)
     : asicSDoc(asicSDoc)
 {
-    auto *dataFile = static_cast<DataFilePrivate*>(asicSDoc->dataFiles().front());
+    auto *dataFile = static_cast<DataFilePrivate*>(asicSDoc->containerDataFiles().front());
     Digest digest;
     dataFile->digest(digest);
     timestampToken = make_unique<TS>(digest, signer->userAgent());
@@ -155,7 +155,7 @@ void SignatureTST::extendSignatureProfile(Signer *signer)
         value = digest.result();
     };
 
-    DataFile *file = asicSDoc->dataFiles().front();
+    DataFile *file = asicSDoc->containerDataFiles().front();
     Digest digest;
     static_cast<DataFilePrivate*>(file)->digest(digest);
     addRef(file->fileName(), file->mediaType(), false, digest);
@@ -222,7 +222,7 @@ void SignatureTST::validate() const
         EXCEPTION_ADD(exception, "Failed to parse timestamp token.");
         throw exception;
     }
-    const DataFile *file = asicSDoc->dataFiles().front();
+    const DataFile *file = asicSDoc->containerDataFiles().front();
     try
     {
         auto digestMethod = signatureMethod();
@@ -298,7 +298,7 @@ void SignatureTST::validate() const
 
 vector<unsigned char> SignatureTST::dataToSign() const
 {
-    return asicSDoc->dataFiles().front()->calcDigest(signatureMethod());
+    return asicSDoc->containerDataFiles().front()->calcDigest(signatureMethod());
 }
 
 vector<unsigned char> SignatureTST::messageImprint() const
diff --git a/src/util/File.cpp b/src/util/File.cpp
index 4f0f31a4b..5461e381b 100644
--- a/src/util/File.cpp
+++ b/src/util/File.cpp
@@ -63,7 +63,7 @@ using f_utimbuf = struct utimbuf;
 #endif
 
 
-static string decodeName(const fs::path &path)
+string File::decodeName(const fs::path &path)
 {
     auto name = path.u8string();
     return {reinterpret_cast<const char*>(name.data()), name.size()};
diff --git a/src/util/File.h b/src/util/File.h
index f48ef71ca..d4b437560 100644
--- a/src/util/File.h
+++ b/src/util/File.h
@@ -35,6 +35,7 @@ namespace digidoc
         {
           public:
               static std::string confPath();
+              static std::string decodeName(const std::filesystem::path &path);
               static std::string digidocppPath();
               static std::filesystem::path encodeName(std::string_view fileName);
               static time_t modifiedTime(const std::string &path);
diff --git a/test/libdigidocpp_boost.cpp b/test/libdigidocpp_boost.cpp
index 1af2c63cf..a627184d4 100644
--- a/test/libdigidocpp_boost.cpp
+++ b/test/libdigidocpp_boost.cpp
@@ -641,6 +641,21 @@ BOOST_AUTO_TEST_CASE(TeRaASiCSContainer)
     BOOST_CHECK_EQUAL("DEMO of SK TSA 2014", ts->TimeStampCertificate().subjectName("CN"));
 }
 
+BOOST_AUTO_TEST_CASE(TeRaASiCSContainerWithoutOnlineValidation)
+{
+    struct RejectOnline final: ContainerOpenCB
+    {
+        bool validateOnline() const final { return false; }
+    } cb;
+
+    auto d = Container::openPtr("test-tera.asics", &cb);
+    BOOST_REQUIRE_EQUAL(d->dataFiles().size(), 1U);
+    BOOST_REQUIRE_EQUAL(d->signatures().size(), 1U);
+    BOOST_CHECK_EQUAL(d->dataFiles().front()->fileName(), "ddoc_for_testing.ddoc");
+    BOOST_CHECK_EQUAL(d->signatures().front()->profile(), "TimeStampToken");
+    BOOST_CHECK_NO_THROW(d->signatures().front()->validate());
+}
+
 BOOST_AUTO_TEST_CASE(TeRaEmptyASiCSContainer)
 {
     auto d = Container::openPtr("test-tera-empty.asics");
diff --git a/vcpkg.json b/vcpkg.json
index f29955282..cacee6e28 100644
--- a/vcpkg.json
+++ b/vcpkg.json
@@ -15,7 +15,7 @@
     "features": {
       "tests": { "description": "Build tests", "dependencies": ["boost-test"] }
     },
-    "builtin-baseline": "67b5ee32c608c87971eed243d4bff140568ebe53",
+    "builtin-baseline": "99e82d9c9f0b281ec11fba48cc8434574a2b6e66",
     "vcpkg-configuration": {
       "overlay-triplets": ["./vcpkg-triplets"],
       "registries": [
@@ -23,7 +23,7 @@
           "kind": "git",
           "repository": "https://github.com/open-eid/vcpkg-ports",
           "reference": "vcpkg-registry",
-          "baseline": "408ae35659d383cf5563a8d9ea943a81bba5c008",
+          "baseline": "6daff78a7188881762bb2c6aef721b3c1f35edb7",
           "packages": ["openssl", "xmlsec"]
         }
       ]