feat: Add CAWG validation to Reader

sdk/examples/cawg_identity.rs

@@ -29,7 +29,6 @@ mod cawg {
         crypto::raw_signature,
         identity::{
             builder::{AsyncIdentityAssertionBuilder, AsyncIdentityAssertionSigner},
-            validator::CawgValidator,
             x509::AsyncX509CredentialHolder,
         },
         AsyncSigner, Builder, Reader, SigningAlg,
@@ -125,10 +124,7 @@ mod cawg {
 
         builder.sign_file_async(&signer, source, &dest).await?;
 
-        let mut reader = Reader::from_file(dest)?;
-
-        reader.post_validate_async(&CawgValidator {}).await?;
-
+        let reader = Reader::from_file_with_cawg_async(dest).await?;
         println!("{reader}");
         Ok(())
     }

sdk/src/identity/validator.rs

@@ -61,7 +61,6 @@ mod tests {
     #[cfg(all(target_arch = "wasm32", not(target_os = "wasi")))]
     use wasm_bindgen_test::wasm_bindgen_test;
 
-    use super::*;
     use crate::{Reader, ValidationState};
 
     const CONNECTED_IDENTITIES_VALID: &[u8] =
@@ -78,9 +77,13 @@ mod tests {
         crate::settings::set_settings_value("verify.verify_trust", false).unwrap();
 
         let mut stream = Cursor::new(CONNECTED_IDENTITIES_VALID);
-        let mut reader = Reader::from_stream("image/jpeg", &mut stream).unwrap();
-        reader.post_validate_async(&CawgValidator {}).await.unwrap();
+
+        let reader = Reader::from_stream_with_cawg_async("image/jpeg", &mut stream)
+            .await
+            .unwrap();
+
         //println!("validation results: {}", reader);
+
         assert_eq!(
             reader
                 .validation_results()
@@ -100,9 +103,13 @@ mod tests {
         crate::settings::set_settings_value("verify.verify_trust", false).unwrap();
 
         let mut stream = Cursor::new(MULTIPLE_IDENTITIES_VALID);
-        let mut reader = Reader::from_stream("image/jpeg", &mut stream).unwrap();
-        reader.post_validate_async(&CawgValidator {}).await.unwrap();
+
+        let reader = Reader::from_stream_with_cawg_async("image/jpeg", &mut stream)
+            .await
+            .unwrap();
+
         println!("validation results: {reader}");
+
         assert_eq!(
             reader
                 .validation_results()
@@ -116,10 +123,13 @@ mod tests {
     }
 
     #[c2pa_test_async]
-    async fn test_post_validate_with_hard_binding_missing() {
+    async fn test_cawg_validate_with_hard_binding_missing() {
         let mut stream = Cursor::new(NO_HARD_BINDING);
-        let mut reader = Reader::from_stream("image/jpeg", &mut stream).unwrap();
-        reader.post_validate_async(&CawgValidator {}).await.unwrap();
+
+        let reader = Reader::from_stream_with_cawg_async("image/jpeg", &mut stream)
+            .await
+            .unwrap();
+
         assert_eq!(
             reader
                 .validation_results()

sdk/src/identity/x509/x509_credential_holder.rs

@@ -88,7 +88,7 @@ mod tests {
             x509::{X509CredentialHolder, X509SignatureVerifier},
             IdentityAssertion,
         },
-        status_tracker::StatusTracker,
+        status_tracker::{LogKind, StatusTracker},
         Builder, Reader, SigningAlg,
     };
 
@@ -134,9 +134,28 @@ mod tests {
         // Read back the Manifest that was generated.
         dest.rewind().unwrap();
 
-        let manifest_store = Reader::from_stream(format, &mut dest).unwrap();
+        let manifest_store = Reader::from_stream_with_cawg_async(format, &mut dest)
+            .await
+            .unwrap();
+
         assert_eq!(manifest_store.validation_status(), None);
 
+        let validation_results = manifest_store.validation_results().unwrap();
+        let active_manifest_results = validation_results.active_manifest().unwrap();
+        let active_manifest_success_codes = active_manifest_results.success();
+
+        let mut ia_success_codes = active_manifest_success_codes.iter().filter(|s| {
+            s.url()
+                .map(|url| url.ends_with("cawg.identity"))
+                .unwrap_or(false)
+                && !s.code().starts_with("assertion.")
+        });
+
+        let ia_success = ia_success_codes.next().unwrap();
+        assert_eq!(ia_success.code(), "signingCredential.trusted");
+        assert!(ia_success.url().unwrap().ends_with("cawg.identity"));
+        assert_eq!(ia_success.kind(), &LogKind::Success);
+
         let manifest = manifest_store.active_manifest().unwrap();
         let mut st = StatusTracker::default();
         let mut ia_iter = IdentityAssertion::from_manifest(manifest, &mut st);

sdk/src/reader.rs

@@ -35,6 +35,7 @@ use crate::{
     crypto::base64,
     dynamic_assertion::PartialClaim,
     error::{Error, Result},
+    identity::validator::CawgValidator,
     jumbf::labels::{manifest_label_from_uri, to_absolute_uri, to_relative_uri},
     jumbf_io,
     manifest::StoreOptions,
@@ -108,13 +109,17 @@ type ValidationFn =
 
 impl Reader {
     /// Create a manifest store [`Reader`] from a stream.  A Reader is used to validate C2PA data from an asset.
+    ///
     /// # Arguments
     /// * `format` - The format of the stream.  MIME type or extension that maps to a MIME type.
     /// * `stream` - The stream to read from.  Must implement the Read and Seek traits. (NOTE: Explain Send trait, required for both sync & async?).
+    ///
     /// # Returns
     /// A [`Reader`] for the manifest store.
+    ///
     /// # Errors
     /// Returns an [`Error`] when the manifest data cannot be read.  If there's no error upon reading, you must still check validation status to ensure that the manifest data is validated.  That is, even if there are no errors, the data still might not be valid.
+    ///
     /// # Example
     /// This example reads from a memory buffer and prints out the JSON manifest data.
     /// ```no_run
@@ -125,11 +130,35 @@ impl Reader {
     /// let reader = Reader::from_stream("image/jpeg", stream).unwrap();
     /// println!("{}", reader.json());
     /// ```
-    #[async_generic()]
+    ///
+    /// # Note
+    /// This function does not validate [CAWG identity] assertions that may be
+    /// contained within any C2PA Manifests. If an async call is feasible, use
+    /// [from_stream_with_cawg_async()]; if not, you can construct an async runtime
+    /// on your own and perform the CAWG validation separately as shown in the
+    /// following example:
+    ///
+    /// ```no_run
+    /// use std::io::Cursor;
+    ///
+    /// use c2pa::{identity::validator::CawgValidator, Reader};
+    /// let mut stream = Cursor::new(include_bytes!("../tests/fixtures/CA.jpg"));
+    /// let mut reader = Reader::from_stream("image/jpeg", stream).unwrap();
+    /// let runtime = tokio::runtime::Runtime::new().unwrap();
+    /// runtime
+    ///     .block_on(reader.post_validate_async(&CawgValidator {}))
+    ///     .unwrap();
+    /// println!("{}", reader.json());
+    /// ```
+    ///
+    /// [CAWG identity]: https://cawg.io/identity
+    /// [from_stream_with_cawg_async()]: Self::from_stream_with_cawg_async
+    #[async_generic]
     #[cfg(not(target_arch = "wasm32"))]
     pub fn from_stream(format: &str, mut stream: impl Read + Seek + Send) -> Result<Reader> {
         let verify = get_settings_value::<bool>("verify.verify_after_reading")?; // defaults to true
         let mut validation_log = StatusTracker::default();
+
         let store = if _sync {
             Store::from_stream(format, &mut stream, verify, &mut validation_log)
         } else {
@@ -139,7 +168,7 @@ impl Reader {
         Self::from_store(store, &validation_log)
     }
 
-    #[async_generic()]
+    #[async_generic]
     #[cfg(target_arch = "wasm32")]
     pub fn from_stream(format: &str, mut stream: impl Read + Seek) -> Result<Reader> {
         let verify = get_settings_value::<bool>("verify.verify_after_reading")?; // defaults to true
@@ -154,23 +183,109 @@ impl Reader {
         Self::from_store(store, &validation_log)
     }
 
+    /// Create a manifest store [`Reader`] from a stream. A `Reader` is used to
+    /// validate C2PA data from an asset. This variation also validates
+    /// [CAWG identity] assertions within the C2PA data.
+    ///
+    /// # Arguments
+    /// * `format` - The format of the stream. MIME type or extension that maps to a MIME type.
+    /// * `stream` - The stream to read from. Must implement the Read and Seek traits. (NOTE: Explain Send trait, required for both sync & async?).
+    ///
+    /// # Returns
+    /// A [`Reader`] for the manifest store.
+    ///
+    /// # Errors
+    /// Returns an [`Error`] when the manifest data cannot be read. If there's no error upon reading, you must still check validation status to ensure that the manifest data is validated. That is, even if there are no errors, the data still might not be valid.
+    ///
+    /// # Example
+    /// This example reads from a memory buffer and prints out the JSON manifest data.
+    /// ```ignore
+    /// # async fn main() {
+    /// use std::io::Cursor;
+    ///
+    /// use c2pa::{identity::validator::CawgValidator, Reader};
+    ///
+    /// let mut stream = Cursor::new(include_bytes!("../tests/fixtures/CA.jpg"));
+    /// let reader = Reader::from_stream_with_cawg_async("image/jpeg", stream)
+    ///     .await
+    ///     .unwrap();
+    /// println!("{}", reader.json());
+    /// # }
+    /// ```
+    ///
+    /// [CAWG identity]: https://cawg.io/identity
+    /// [from_stream_with_cawg_async()]: Self::from_stream_with_cawg_async
+    #[cfg(not(target_arch = "wasm32"))]
+    pub async fn from_stream_with_cawg_async(
+        format: &str,
+        stream: impl Read + Seek + Send,
+    ) -> Result<Reader> {
+        let mut reader = Self::from_stream_async(format, stream).await?;
+
+        if get_settings_value::<bool>("verify.verify_after_reading")? {
+            reader.post_validate_async(&CawgValidator {}).await?;
+        }
+
+        Ok(reader)
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    pub async fn from_stream_with_cawg_async(
+        format: &str,
+        stream: impl Read + Seek,
+    ) -> Result<Reader> {
+        let mut reader = Self::from_stream_async(format, stream).await?;
+
+        if get_settings_value::<bool>("verify.verify_after_reading")? {
+            reader.post_validate_async(&CawgValidator {}).await?;
+        }
+
+        Ok(reader)
+    }
+
     #[cfg(feature = "file_io")]
     /// Create a manifest store [`Reader`] from a file.
     /// If the `fetch_remote_manifests` feature is enabled, and the asset refers to a remote manifest, the function fetches a remote manifest.
+    ///
     /// NOTE: If the file does not have a manifest store, the function will check for a sidecar manifest with the same base file name and a .c2pa extension.
+    ///
     /// # Arguments
     /// * `path` - The path to the file.
+    ///
     /// # Returns
     /// A [`Reader`] for the manifest store.
+    ///
     /// # Errors
     /// Returns an [`Error`] when the manifest data cannot be read from the specified file.  If there's no error upon reading, you must still check validation status to ensure that the manifest data is validated.  That is, even if there are no errors, the data still might not be valid.
+    ///
     /// # Example
-    /// This example
+    ///
     /// ```no_run
     /// use c2pa::Reader;
     /// let reader = Reader::from_file("path/to/file.jpg").unwrap();
     /// ```
-    #[async_generic()]
+    ///
+    /// # Note
+    /// This function does not validate [CAWG identity] assertions that may be
+    /// contained within any C2PA Manifests. If an async call is feasible, use
+    /// [from_file_with_cawg_async()]; if not, you can construct an async runtime
+    /// on your own and perform the CAWG validation separately as shown in the
+    /// following example:
+    ///
+    /// ```ignore
+    /// use c2pa::{identity::validator::CawgValidator, Reader};
+    ///
+    /// let mut reader = Reader::from_file("path/to/file.jpg").unwrap();
+    /// let runtime = tokio::runtime::Runtime::new().unwrap();
+    /// runtime
+    ///     .block_on(reader.post_validate_async(&CawgValidator {}))
+    ///     .unwrap();
+    /// println!("{}", reader.json());
+    /// ```
+    ///
+    /// [CAWG identity]: https://cawg.io/identity
+    /// [from_file_with_cawg_async()]: Self::from_file_with_cawg_async
+    #[async_generic]
     pub fn from_file<P: AsRef<std::path::Path>>(path: P) -> Result<Reader> {
         let path = path.as_ref();
         let format = crate::format_from_path(path).ok_or(crate::Error::UnsupportedType)?;
@@ -204,6 +319,58 @@ impl Reader {
         }
     }
 
+    #[cfg(feature = "file_io")]
+    /// Create a manifest store [`Reader`] from a file.
+    /// If the `fetch_remote_manifests` feature is enabled, and the asset refers to a remote manifest, the function fetches a remote manifest.
+    ///
+    /// NOTE: If the file does not have a manifest store, the function will check for a sidecar manifest with the same base file name and a .c2pa extension.
+    ///
+    /// # Arguments
+    /// * `path` - The path to the file.
+    ///
+    /// # Returns
+    /// A [`Reader`] for the manifest store.
+    ///
+    /// # Errors
+    /// Returns an [`Error`] when the manifest data cannot be read from the specified file.  If there's no error upon reading, you must still check validation status to ensure that the manifest data is validated.  That is, even if there are no errors, the data still might not be valid.
+    ///
+    /// # Example
+    ///
+    /// ```no_run
+    /// use c2pa::Reader;
+    /// let reader = Reader::from_file("path/to/file.jpg").unwrap();
+    /// ```
+    ///
+    /// # Note
+    /// This function does not validate [CAWG identity] assertions that may be
+    /// contained within any C2PA Manifests. If an async call is feasible, use
+    /// [from_file_with_cawg_async()]; if not, you can construct an async runtime
+    /// on your own and perform the CAWG validation separately as shown in the
+    /// following example:
+    ///
+    /// ```ignore
+    /// use c2pa::{identity::validator::CawgValidator, Reader};
+    ///
+    /// let mut reader = Reader::from_file("path/to/file.jpg").unwrap();
+    /// let runtime = tokio::runtime::Runtime::new().unwrap();
+    /// runtime
+    ///     .block_on(reader.post_validate_async(&CawgValidator {}))
+    ///     .unwrap();
+    /// println!("{}", reader.json());
+    /// ```
+    ///
+    /// [CAWG identity]: https://cawg.io/identity
+    /// [from_file_with_cawg_async()]: Self::from_file_with_cawg_async
+    pub async fn from_file_with_cawg_async<P: AsRef<std::path::Path>>(path: P) -> Result<Reader> {
+        let mut reader = Self::from_file_async(path).await?;
+
+        if get_settings_value::<bool>("verify.verify_after_reading")? {
+            reader.post_validate_async(&CawgValidator {}).await?;
+        }
+
+        Ok(reader)
+    }
+
     /// Create a manifest store [`Reader`] from a JSON string.
     /// # Arguments
     /// * `json` - A JSON string containing a manifest store definition.