# Non‑Compliant Date/Time Validation in c2patool?

[bgon]

Component

c2patool

If Other, please specify

No response

Version

v0.26.20

Platform

Linux

What happened?

According to the C2PA specification, date/time values in assertions (such as when in an action or dateTime in metadata) must be serialized in CBOR using tag 0, following the RFC 3339 format as refined by RFC 4287.
Specification reference:
https://spec.c2pa.org/specifications/specifications/2.3/specs/C2PA_Specification.html#_specifications_of_time_in_assertions

“The default specification for a date/time value in an assertion is the date/time format which is serialized in CBOR as tag number 0 (RFC 8949, 3.4.1) and represented in CDDL as type tdate.”

However, c2patool v0.26.20 appears to accept date/time values encoded as plain CBOR text strings, even when the required timezone indicator (Z or an explicit offset) is missing. This behavior seems inconsistent with the requirement that Tag 0 timestamps must include a timezone per RFC 4287.

Below are examples covering Claim V1/V2 and both CBOR Tag 0 and plain‑text serialization.

date/time serialized in CBOR as tag number 0

Minden Pictures Inc. (Claim V1), valid

cbor-diag --to annotated (Annotated Hex):

68                                                     # text(8)
   6461746554696d65                                    #    "dateTime"
c0                                                     # standard datetime string, tag(0)
   78 18                                               #    text(24)
      323032332d30332d31345430393a34313a30302e3137365a #      "2023-03-14T09:41:00.176Z"
                                                       #    epoch(1678786860.176)

cbor-diag --to diag (JSON):

"dateTime": 0("2023-03-14T09:41:00.176Z")

c2patool-v0.26.20:

"dateTime": "2023-03-14T09:41:00.176Z"

vivo X300 camera (Claim V2), stderror

cbor-diag --to annotated (Annotated Hex):

64                                             # text(4)
   7768656e                                    #   "when"
c0                                             # standard datetime string, tag(0)
   74                                          #   text(20)
      323032352d31312d32385431323a34313a33395a #     "2025-11-28T12:41:39Z"
                                               #   epoch(1764333699)

cbor-diag --to diag (JSON):

"when": 0("2025-11-28T12:41:39Z")

c2patool-v0.26.20:

Error: could not decode assertion c2pa.actions.v2 (version 2, content type application/cbor): Syntax error: Unsupported type in option

Caused by:
    Syntax error: Unsupported type in option

date/time serialized in CBOR as text

note: it looks that the c2patool v>=0.26.19 generated manifest breaks the schema #1797

Microsoft Responsible AI Image Provenance (Claim V1), valid

cbor-diag --to annotated (Annotated Hex):

64                                            # text(4)
   7768656e                                   #   "when"
74                                            # text(20)
   323032352d31312d31385430323a33383a34315a   #   "2025-11-18T02:38:41Z"

cbor-diag --to diag (JSON):

"when": "2025-11-18T02:38:41Z"

c2patool-v0.26.20:

"when": {
    "tag": 0,
    "value": "2025-11-18T02:38:41Z"
},

Comite International des Telecommunications de Presse (Claim V2), valid despite explicit timezone missing

cbor-diag --to annotated (Annotated Hex):

64                                                 # text(4)
   7768656e                                        #   "when"
78 1a                                              # text(26)
   323032352d30332d31385432313a3235                #   "2025-03-18T21:25"
   3a35372e313533323738                            #   ":57.153278"

cbor-diag --to diag (JSON):

"when": "2025-03-18T21:25:57.153278"

c2patool-v0.26.20:

"when": {
    "tag": 0,
    "value": "2026-01-21T09:27:56.200212" // note: the explicit timezone or Z is missing
}

Adobe Photoshop 27.0.0 (Claim V1), valid

cbor-diag --to annotated (Annotated Hex):

68                                                  # text(8)
   6461746554696d65                                 #   "dateTime"
78 18                                               # text(24)
   323032352d31302d32375431323a31313a31342e3533315a #   "2025-10-27T12:11:14.531Z"

cbor-diag --to diag (JSON):

"dateTime": "2025-10-27T12:11:14.531Z"

c2patool-v0.26.20:

"dateTime": {
    "tag": 0,
    "value": "2025-10-27T12:11:14.531Z"
},

What did you expect to happen?

What is the correct, specification‑compliant way to encode date/time values?