diff --git a/mdx/_rules/check_mdui.xsl b/mdx/_rules/check_mdui.xsl
index 796c1d3f..a2a53f44 100644
--- a/mdx/_rules/check_mdui.xsl
+++ b/mdx/_rules/check_mdui.xsl
@@ -146,6 +146,12 @@
             </xsl:call-template>
         </xsl:if>
 
+        <xsl:if test="contains(., '&#xA0;')">
+            <xsl:call-template name="error">
+                <xsl:with-param name="m">mdui:Logo contains non-breaking space</xsl:with-param>
+            </xsl:call-template>
+        </xsl:if>
+		
 		<!--
 			Require that the URL starts with https://
 			
diff --git a/mdx/_rules/check_saml2meta.xsl b/mdx/_rules/check_saml2meta.xsl
index 1e67bc38..b3990b9b 100644
--- a/mdx/_rules/check_saml2meta.xsl
+++ b/mdx/_rules/check_saml2meta.xsl
@@ -28,6 +28,15 @@
 	-->
 	
 	<xsl:template match="md:SPSSODescriptor">
+
+        <xsl:variable name="indices" select="md:ArtifactResolutionService/@index"/>
+        <xsl:variable name="distinct.indices" select="set:distinct($indices)"/>
+        <xsl:if test="count($indices) != count($distinct.indices)">
+            <xsl:call-template name="error">
+                <xsl:with-param name="m">ArtifactResolutionService index values not all different</xsl:with-param>
+            </xsl:call-template>
+        </xsl:if>
+
 		<xsl:variable name="indices" select="md:AssertionConsumerService/@index"/>
 		<xsl:variable name="distinct.indices" select="set:distinct($indices)"/>
 		<xsl:if test="count($indices) != count($distinct.indices)">
diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index 769d0b68..40f11eb9 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -1032,13 +1032,8 @@
         A pipeline stage that removes all XML comments from items.
     -->
     
-    <bean id="stripComments" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="strip-comments.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="stripComments" parent="XSLTransformationStage"
+        p:XSLResource="classpath:strip-comments.xsl"/>
     
     <!--
         everythingSelector
@@ -1075,13 +1070,8 @@
         presented, for example by removing redundant attributes or elements which only have
         meaning when added by the UK federation registrar.
     -->
-    <bean id="cleanImport" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="clean-import.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="cleanImport" parent="XSLTransformationStage"
+        p:XSLResource="classpath:clean-import.xsl"/>
     
     <!--
         trimImportElementWhitespace
diff --git a/mdx/conventions.md b/mdx/conventions.md
index 4eb41a15..a4cd3308 100644
--- a/mdx/conventions.md
+++ b/mdx/conventions.md
@@ -10,10 +10,6 @@ An underscore ('`_`') at the start of a directory name indicates that the direct
 
 Note that the `schema` directory is functional but does not follow this convention, instead following the convention established for classpath schema resources used by the Shibboleth project.
 
-### OpenSSL Blacklists Directory
-
-The `_openssl_blacklists` directory holds a copy of the Debian weak key blacklists, extracted from Debian 7.2 "Wheezy". These blacklists are in OpenSSL format.
-
 ### Ruleset Directory
 
 The `_rules` subdirectory of `/mdx/` holds checking rulesets.
diff --git a/mdx/int_cobweb/beans.xml b/mdx/int_cobweb/beans.xml
index 67b9d2ea..2922f2fc 100644
--- a/mdx/int_cobweb/beans.xml
+++ b/mdx/int_cobweb/beans.xml
@@ -34,13 +34,8 @@
     <!--
         Signing certificate.
     -->
-    <bean id="int_cobweb_signingCertificate" parent="X509CertificateFactoryBean">
-        <property name="certificateFile">
-            <bean class="java.io.File">
-                <constructor-arg value="${basedir}/mdx/int_cobweb/cobweb.pem"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="int_cobweb_signingCertificate" parent="X509CertificateFactoryBean"
+        p:resource="classpath:int_cobweb/cobweb.pem"/>
     
     <!--
         Check signing signature.
diff --git a/mdx/int_edugain/verbs.xml b/mdx/int_edugain/verbs.xml
index ed89148c..f345a97d 100644
--- a/mdx/int_edugain/verbs.xml
+++ b/mdx/int_edugain/verbs.xml
@@ -105,13 +105,9 @@
                     p:designatedEntities-ref="int_edugain_verify_blacklist"/>
                 
                 <!-- flag up any remaining entities -->
-                <bean id="check_recovered" parent="XSLValidationStage">
-                    <property name="XSLResource">
-                        <bean parent="FileSystemResource">
-                            <constructor-arg value="${basedir}/mdx/int_edugain/check_recovered.xsl"/>
-                        </bean>
-                    </property>
-                </bean>
+                <bean id="check_recovered" parent="XSLValidationStage"
+                    p:XSLResource="classpath:int_edugain/check_recovered.xsl"/>
+
                 <ref bean="errorTerminatingFilter"/>
             </list>
         </property>
diff --git a/mdx/test/beans.xml b/mdx/test/beans.xml
index be4fce06..2795c95b 100644
--- a/mdx/test/beans.xml
+++ b/mdx/test/beans.xml
@@ -15,15 +15,8 @@
     <!--
         Fetch the aggregate aggregate.
     -->
-    <bean id="test_aggregate" parent="stage_parent"
-        class="net.shibboleth.metadata.dom.DomFilesystemSourceStage">
-        <property name="parserPool" ref="parserPool"/>
-        <property name="source">
-            <bean class="java.io.File">
-                <constructor-arg value="${basedir}/mdx/test/input.xml"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="test_aggregate" parent="DOMResourceSourceStage"
+        p:DOMResource="classpath:test/input.xml"/>
     
     <!--
         Fetch and process the entities as a collection.
diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index 1dd7e60a..bd769aa0 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -68,13 +68,8 @@
     <!--
         Metadata signing certificate.
     -->
-    <bean id="uk_signingCertificate" parent="X509CertificateFactoryBean">
-        <property name="certificateFile">
-            <bean class="java.io.File">
-                <constructor-arg value="${basedir}/mdx/uk/ukfederation-2014.pem"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_signingCertificate" parent="X509CertificateFactoryBean"
+        p:resource="classpath:uk/ukfederation-2014.pem"/>
     
     
     <!--
@@ -143,12 +138,8 @@
         This transform can be run on individual EntityDescriptors or on an
         aggregate EntitiesDescriptor.
     -->
-    <bean id="uk_processScopes" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/scopes.xsl"/>
-            </bean>
-        </property>
+    <bean id="uk_processScopes" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/scopes.xsl">
         <property name="transformParameters">
             <map>
                 <entry key="members" value-ref="uk_members"/>
@@ -197,13 +188,8 @@
         
         Adds "mailto:" to md:EmailAddress elements which don't already have it.
     -->
-    <bean id="uk_fix_mailto" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/fix_mailto.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_fix_mailto" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/fix_mailto.xsl"/>
     
     
     <!--
@@ -211,12 +197,8 @@
         
         Checks specific to the UK registrar function.
     -->
-    <bean id="check_ukreg" parent="XSLValidationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/check_ukreg.xsl"/>
-            </bean>
-        </property>
+    <bean id="check_ukreg" parent="XSLValidationStage"
+        p:XSLResource="classpath:uk/check_ukreg.xsl">
         <property name="transformParameters">
             <map>
                 <entry key="members" value-ref="uk_members"/>
@@ -228,49 +210,29 @@
     <!--
         check_uk_keydesc_key
     -->
-    <bean id="check_uk_keydesc_key" parent="XSLValidationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/check_uk_keydesc_key.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="check_uk_keydesc_key" parent="XSLValidationStage"
+        p:XSLResource="classpath:uk/check_uk_keydesc_key.xsl"/>
 
 
     <!--
         check_uk_mdattr
     -->
-    <bean id="check_uk_mdattr" parent="XSLValidationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/check_uk_mdattr.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="check_uk_mdattr" parent="XSLValidationStage"
+        p:XSLResource="classpath:uk/check_uk_mdattr.xsl"/>
     
     
     <!--
         check_uk_mdrps
     -->
-    <bean id="check_uk_mdrps" parent="XSLValidationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/check_uk_mdrps.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="check_uk_mdrps" parent="XSLValidationStage"
+        p:XSLResource="classpath:uk/check_uk_mdrps.xsl"/>
     
     
     <!--
         check_uk_urlenc
     -->
-    <bean id="check_uk_urlenc" parent="XSLValidationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/check_uk_urlenc.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="check_uk_urlenc" parent="XSLValidationStage"
+        p:XSLResource="classpath:uk/check_uk_urlenc.xsl"/>
     
 
     <!--
@@ -278,13 +240,8 @@
         
         This stage performs any standard cleanup required for UK federation fragment files.
     -->
-    <bean id="uk_processFragment" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/fragment.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_processFragment" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/fragment.xsl"/>
     
     
     <!--
@@ -428,13 +385,8 @@
         
         Strip those UK federation extensions which we never publish.
     -->
-    <bean id="uk_stripExtensions" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/strip_extensions.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_stripExtensions" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/strip_extensions.xsl"/>
     
 
     <!--
@@ -452,13 +404,8 @@
         used in an XML document.  This one is UK-specific, as it makes specific choices
         in order to limit the number of prefixes used.
     -->
-    <bean id="uk_normaliseNamespaces" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/ns_norm_uk.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_normaliseNamespaces" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/ns_norm_uk.xsl"/>
     
     <!--
         *************************************************
@@ -523,12 +470,8 @@
         
         Input is an aggregate of all registered entities, output is the HTML statistics.
     -->
-    <bean id="uk_generateStatistics" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/statistics.xsl"/>
-            </bean>
-        </property>
+    <bean id="uk_generateStatistics" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/statistics.xsl">
         <property name="transformParameters">
             <map>
                 <entry key="memberDocument" value-ref="uk_membersDocument"/>
diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml
index 8e826937..a51d2e67 100644
--- a/mdx/uk/generate.xml
+++ b/mdx/uk/generate.xml
@@ -43,13 +43,8 @@
         Remove entity-level Scope elements, leaving only the ones associated
         with role descriptors.    
     -->
-    <bean id="stripEntityScopes" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/entity_scopes.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="stripEntityScopes" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/entity_scopes.xsl"/>
     
     <!--
         finalise_parent
@@ -57,12 +52,8 @@
         Template for a stage used in each output pipeline which performs
         final tweaks on the document.
     -->
-    <bean id="finalise_parent" abstract="true" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/final_tweak.xsl"/>
-            </bean>
-        </property>
+    <bean id="finalise_parent" abstract="true" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/final_tweak.xsl">
         <property name="transformParameters">
             <map>
                 <entry key="publisher" value-ref="uk_federation_uri"/>
@@ -101,24 +92,14 @@
         Patch any @use-less KeyName descriptors in IdP roles
         for the benefit of Shib SPs pre-1.3.1.
     -->
-    <bean id="fixup_keyuse" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="ClassPathResource">
-                <constructor-arg value="uk/fixup_keyuse.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="fixup_keyuse" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/fixup_keyuse.xsl"/>
     
     <!--
         check_fixup_keyuse
     -->
-    <bean id="check_fixup_keyuse" parent="XSLValidationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/check_fixup_keyuse.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="check_fixup_keyuse" parent="XSLValidationStage"
+        p:XSLResource="classpath:uk/check_fixup_keyuse.xsl"/>
     
     <!--
         checkPublishable
@@ -402,13 +383,8 @@
         </property>
     </bean>
     
-    <bean id="CDSNormaliseNamespaces" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/ns_norm_cds.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="CDSNormaliseNamespaces" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/ns_norm_cds.xsl"/>
 
     <!--
         *******************************************
@@ -487,13 +463,8 @@
         </property>
     </bean>
     
-    <bean id="uk_normaliseFallback" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/ns_norm_back.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_normaliseFallback" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/ns_norm_back.xsl"/>
     
     <bean id="serializeUnsignedFallbackAggregate" parent="SerializationStage">
         <property name="outputFile">
@@ -546,13 +517,8 @@
         </property>
     </bean>
     
-    <bean id="uk_normaliseTest" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/ns_norm_test.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_normaliseTest" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/ns_norm_test.xsl"/>
     
     <bean id="serializeUnsignedTestAggregate" parent="SerializationStage">
         <property name="outputFile">
@@ -602,13 +568,8 @@
         </property>
     </bean>
     
-    <bean id="uk_normaliseExport" parent="XSLTransformationStage">
-        <property name="XSLResource">
-            <bean parent="FileSystemResource">
-                <constructor-arg value="${basedir}/mdx/uk/ns_norm_export.xsl"/>
-            </bean>
-        </property>
-    </bean>
+    <bean id="uk_normaliseExport" parent="XSLTransformationStage"
+        p:XSLResource="classpath:uk/ns_norm_export.xsl"/>
     
     <bean id="uk_exportSelector" parent="XPathItemSelectionStrategy">
         <constructor-arg value="/md:EntityDescriptor[not(md:Extensions/ukfedlabel:ExportOptOut)]"/>
diff --git a/mdx/uk/statistics.xsl b/mdx/uk/statistics.xsl
index ee396fa7..9cf1cbad 100644
--- a/mdx/uk/statistics.xsl
+++ b/mdx/uk/statistics.xsl
@@ -1799,7 +1799,10 @@
             <xsl:variable name="entities.openathens.virtual"
                 select="$entities.openathens.virtual.in[
                     descendant::md:AttributeService/@Location=
-                        'https://gateway.athensams.net:5057/services/SAML11AttributeAuthority']"/>
+                        'https://gateway.athensams.net:5057/services/SAML11AttributeAuthority' or
+                    descendant::md:SingleSignOnService[starts-with(@Location,
+                        'https://login.openathens.net/saml/')]
+                    ]"/>
             <xsl:variable name="entities.openathens.virtual.out"
                 select="set:difference($entities.openathens.virtual.in, $entities.openathens.virtual)"/>
             
diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml
index ead03397..eadd2695 100644
--- a/mdx/uk/verbs.xml
+++ b/mdx/uk/verbs.xml
@@ -57,13 +57,8 @@
             <list>
                 <ref bean="uk_registeredEntities"/>
                 <ref bean="assemble"/>
-                <bean id="process" parent="XSLTransformationStage">
-                    <property name="xslResource">
-                        <bean parent="ClassPathResource">
-                            <constructor-arg value="uk/sp_mdui_test.xsl"/>
-                        </bean>
-                    </property>
-                </bean>
+                <bean id="process" parent="XSLTransformationStage"
+                    p:XSLResource="classpath:uk/sp_mdui_test.xsl"/>
                 <bean id="serialize" parent="SerializationStage">
                     <property name="outputFile">
                         <bean class="java.io.File">
@@ -239,22 +234,12 @@
                 <ref bean="uk_fix_mailto"/>
                 
                 <!-- transform into a fragment using our local conventions -->
-                <bean id="importTransform" parent="XSLTransformationStage">
-                    <property name="XSLResource">
-                        <bean parent="ClassPathResource">
-                            <constructor-arg value="uk/import.xsl"/>
-                        </bean>
-                    </property>
-                </bean>
+                <bean id="importTransform" parent="XSLTransformationStage"
+                    p:XSLResource="classpath:uk/import.xsl"/>
                 
                 <!-- normalise namespaces in a specific way -->
-                <bean id="normalizeFragment" parent="XSLTransformationStage">
-                    <property name="XSLResource">
-                        <bean parent="FileSystemResource">
-                            <constructor-arg value="${basedir}/mdx/uk/ns_norm_fragment.xsl"/>
-                        </bean>
-                    </property>
-                </bean>
+                <bean id="normalizeFragment" parent="XSLTransformationStage"
+                    p:XSLResource="classpath:uk/ns_norm_fragment.xsl"/>
                 
                 <!-- check the transformed input -->
                 <ref bean="checkSchemas"/>