You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/manifest/reading/legacy.md
+10-7Lines changed: 10 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,21 +5,25 @@ title: Reading legacy manifest data
5
5
6
6
As much as possible, an application should **write** manifest data that conforms to the recent [version 2.2](https://c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html) C2PA technical specification, but should be able to **read and validate** manifest data that conforms to earlier versions of the specification. This ensures that your application is "backward-compatible" and can still validate older assets with claims that were written in the past.
7
7
8
-
<divclass="review-comment">
9
-
For READING old claims (only) … v1 actions and ingredients
10
-
</div>
11
-
12
8
## Legacy ingredients
13
9
14
10
Existing manifests may contain any of these three kinds of ingredients:
15
11
- V1, with label `c2pa.ingredient` (deprecated).
16
12
- V2, with label `c2pa.ingredient.v2` (deprecated).
17
-
- V3, with label `c2pa.ingredient.v3`, which addresses the issue of validating ingredients after redaction.
13
+
- V3, with label `c2pa.ingredient.v3`, which addresses the issue of validating ingredients after redaction.
14
+
15
+
<divclass="review-comment">
16
+
What should we say about reading v1 and v2 ingredients?
17
+
</div>
18
18
19
19
## Legacy actions
20
20
21
21
Existing manifests may contain two versions of actions: original v1 actions, with label `c2pa.actions`, and revised v2 actions, with label `c2pa.actions.v2`. While a v1 action is fully specified in its actions array, a v2 action may either be fully specified in an element of the actions array or it may be derived from an element in the templates array with the same action name.
22
22
23
+
<divclass="review-comment">
24
+
What should we say about reading v1 actions?
25
+
</div>
26
+
23
27
## Legacy metadata assertions
24
28
25
29
Existing manifests may contain individual assertions for each metadata standard:
@@ -29,7 +33,6 @@ Existing manifests may contain individual assertions for each metadata standard:
29
33
30
34
In the latest version of the SDK, Exif and IPTC assertions are now CAWG assertions, and the CreativeWork assertion is not supported at all.
31
35
32
-
33
36
### Exif assertion
34
37
35
38
Exchangeable image file (Exif) format is a standard for storing technical metadata in image files of JPEG, TIFF, PNG, and other formats. Most digital cameras (including smartphones), scanners and other digital capture devices use Exif to store information such as device make and model, shutter speed, ISO number, date and time of capture, location, and so on. For more information on Exif, see the [Exif specification](https://www.cipa.jp/std/documents/download_e.html?DC-008-Translation-2019-E).
@@ -139,7 +142,7 @@ For example:
139
142
]
140
143
```
141
144
142
-
## Training and data mining assertion
145
+
## Legacy training and data mining assertion
143
146
144
147
Old manifests may have training and data mining assertions with the following entry keys:
The [Creator Assertions Working Group (CAWG)](https://cawg.io/) identity assertion enables a credential holder to prove control over a digital identity and to use that identity to document a content creator’s role(s) in a C2PA asset’s lifecycle.
7
7
8
-
<divclass="review-comment">
9
-
Revise to focus on reading these assertions.
10
-
</div>
11
-
12
8
The SDK can read and validate CAWG identity assertions provided:
13
9
14
10
- Using an [X.509 certificate](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures) to sign the identity claims. Enterprises or large organizations can use this approach to assert their identity in a particular trust ecosystem; for example, a news organization or publisher. The SDK can validate and sign these claims.
15
11
- Using an [identity claim aggregator](https://cawg.io/identity/1.1/#_identity_claims_aggregation). Individuals can use this approach to document their role in creating an asset by using identity signals collected and verified by a third-party aggregator. The SDK can validate these claims only. Signing is not supported.
16
12
17
-
## Identity assertions provided using an X.509 certificate
18
-
19
-
In an identity assertion by using an X.509 certificate, the value of `signer_payload.sig_type` is `cawg.x509.cose`. The signature value must be a COSE signature as described in the [CAWG Identity Assertion technical specification](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures).
13
+
## Assertions signed using a certificate
20
14
21
-
## Identity assertions provided using a claim aggregator
15
+
In an identity assertion provided by using an X.509 certificate, the value of `signer_payload.sig_type` is `cawg.x509.cose`. The signature value must be a COSE signature as described in the [CAWG Identity Assertion technical specification](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures).
22
16
23
-
As defined in the [CAWG Identity Assertion technical specification](https://cawg.io/identity/1.1/#_identity_claims_aggregation), an identity assertion can be signed using a trusted third-party intermediary known as a _identity claims aggregator_ to gather these signals and to restate them on their behalf.
17
+
## Assertions signed using a claim aggregator
24
18
25
-
The identity claims aggregator:
19
+
An identity assertion can also be signed using a trusted third-party intermediary known as an [_identity claims aggregator_](https://cawg.io/identity/1.1/#_identity_claims_aggregation). The identity claims aggregator:
26
20
27
21
- Collects and verifies identity attestation claims from various identity providers such as social media sites and ID verification vendors.
28
22
- Creates a unique asset-specific credential that binds the identity attestation claims to a specific asset.
29
23
30
-
## Identity assertion
24
+
In an identity assertion provided by using an identity clarims aggregator, the value of `signer_payload.sig_type` is `cawg.identity_claims_aggregation`.
25
+
26
+
### Example
31
27
32
28
An identity assertion using an identity claims aggregator has this general form in JSON:
33
29
@@ -65,7 +61,7 @@ An identity assertion using an identity claims aggregator has this general form
65
61
]
66
62
```
67
63
68
-
###Verified identity types
64
+
## Verified identity types
69
65
70
66
The following table describes the allowed values of the `type` property of `verifiedIdentities` array elements.
Copy file name to clipboardExpand all lines: docs/manifest/writing/assertions-actions.md
+8-10Lines changed: 8 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -31,21 +31,19 @@ The standard form of an assertion in a JSON manifest is:
31
31
Changes include:
32
32
-`c2pa.data_mining` > `cawg.data_mining`, etc. were renamed, with xref.
33
33
-`SoftwareAgent` is a [ClaimGeneratorInfo](../json-ref/manifest-def.mdx#claimgeneratorinfo) structure instead of a string.
34
-
35
-
- Actions are now V3 actions
36
34
- Ingredients are now V2 ingredients
37
35
38
36
#### V2 actions
39
37
40
38
The [C2PA Technical Specification](https://c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html#_actions) describes expanded v2 actions. While v1 actions are fully specified in the actions array v2 actions may either be specified by an element of the actions array or from an element in the templates array with the same action name.
41
39
42
40
<divclass="review-comment">
43
-
The CAI APIs can read all v2 actions and write most v2 actions.
41
+
The CAI APIs can read all v2 actions and write most v2 actions. What v2 actions can it NOT write?
44
42
</div>
45
43
46
44
V1 actions have a label of `c2pa.actions` v2 actions have a label of `c2pa.actions.v2`. Actions are modelled after XMP ResourceEvents, but with a number of C2PA-specific adjustments.
47
45
48
-
v1 actions are fully specified in its actions array. However, in v2, an action may either be fully specified in an element of the actions array or it may be derived from an element in the templates array with the same action name.
46
+
V1 actions are fully specified in its actions array. However, a v2 action may either be fully specified in an element of the actions array or it may be derived from an element in the templates array with the same action name.
49
47
50
48
## C2PA standard assertions
51
49
@@ -105,7 +103,7 @@ Update assertions
105
103
106
104
-->
107
105
108
-
###Actions
106
+
## Actions
109
107
110
108
An action is an assertion that provides information about creation, edits, and other things that have occurred to an asset. In the manifest, an `actions` assertion is an array of [AssertionDefinition](../json-ref/manifest-def.mdx#assertiondefinition) objects. For example:
111
109
@@ -137,13 +135,13 @@ Each object in the `actions` array has the following standard properties.
137
135
|`softwareAgent`| No | The software or hardware used to perform the action. |`"Adobe Firefly"`|
138
136
|`parameters`| No | Additional information describing the action; see [Parameters](#parameters)| Reference to ingredients in the `org.cai.ingredientIds` array. |
139
137
140
-
####Action names
138
+
### Action names
141
139
142
140
The value of the `action` property must be either one of the pre-defined [standard C2PA action strings](https://c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html#_actions) of the form `c2pa.*` or a custom action name. The set of standard C2PA actions includes fundamental ones as `c2pa.created` for when an asset is first created, and others (`c2pa.cropped`, `c2pa.resized`, and so on) for when an asset's content is modified in some way.
143
141
144
142
For the complete list of standard actions, see the [C2PA Technical Specification](https://c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html#_actions).
145
143
146
-
####Digital source type
144
+
### Digital source type
147
145
148
146
Use the `digitalSourceType` property to specify how an asset was created or modified, for example "digital capture", "digitized from negative," or "trained algorithmic media."
149
147
@@ -172,7 +170,7 @@ The value of `digitalSourceType` is one of the URLs specified by the Internation
172
170
This table is provided for convenience. For the authoritative list, see the [IPTC NewsCodes Digital Source Type scheme (controlled vocabulary)](https://cv.iptc.org/newscodes/digitalsourcetype/).
173
171
:::
174
172
175
-
####Generative AI action
173
+
### Generative AI action
176
174
177
175
To specify that an asset was created using generative AI, use the `c2pa.created` action with `digitalSourceType` that's one of:
178
176
-`trainedAlgorithmicMedia` for an asset created by generative AI tools.
@@ -201,7 +199,7 @@ For other possible values of `digitalSourceType`, see [Digital source type](#dig
201
199
202
200
Where `<TOOL_NAME>` is the name of the generative AI tool or service.
203
201
204
-
####Parameters
202
+
### Parameters
205
203
206
204
The `parameters` property can contain any data that provide more details on the action, for example:
207
205
@@ -415,7 +413,7 @@ For example:
415
413
Assertions with the `cawg.training-mining` label provide information about whether an asset with C2PA metadata may be used as part of a data mining or AI/ML (artificial intelligence / machine learning) workflows, including whether permission is granted to use an asset in ML training or inference.
416
414
417
415
:::note
418
-
Training and data mining assertions formerly had `c2pa.*` labels.
416
+
Training and data mining assertions formerly had `c2pa.*` labels. See [Legacy training and data mining assertion](../reading/legacy.md#legacy-training-and-data-mining-assertion) for more information.
Copy file name to clipboardExpand all lines: docs/manifest/writing/cawg-id.md
+5-7Lines changed: 5 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,20 +3,18 @@ id: cawg-id
3
3
title: Writing CAWG identity assertions
4
4
---
5
5
6
-
The [Creator Assertions Working Group (CAWG)](https://cawg.io/) identity assertion enables a credential holder to prove control over a digital identity and to use that identity to document a content creator’s role(s) in a C2PA asset’s lifecycle.
6
+
The [Creator Assertions Working Group (CAWG)](https://cawg.io/) identity assertion enables a credential holder to prove control over a digital identity and to use that identity to document a content creator’s role(s) in an asset’s lifecycle.
7
7
8
-
The SDK can write and sign claims for CAWG identity assertions provided using an [X.509 certificate](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures) to sign the identity claims. Enterprises or large organizations can use this approach to assert their identity in a particular trust ecosystem; for example, a news organization or publisher. The SDK can validate and sign these claims.
8
+
The SDK can write and sign claims for CAWG identity assertions provided using an [X.509 certificate](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures).
9
9
10
10
:::note
11
-
CAWG identity assertions can also be created using an [identity claim aggregator](https://cawg.io/identity/1.1/#_identity_claims_aggregation), but the SDK only read and validate claims for these kinds of assertions. It cannot write them.
11
+
CAWG identity assertions can also be created using an [identity claim aggregator](https://cawg.io/identity/1.1/#_identity_claims_aggregation), but the SDK only _read and validate_ claims for these kinds of assertions. It cannot write them.
12
12
:::
13
13
14
14
## Using an X.509 certificate
15
15
16
16
When providing an identity assertion by using an X.509 certificate, the value of `signer_payload.sig_type` must be `cawg.x509.cose`. The signature value must be a COSE signature as described in the [CAWG Identity Assertion technical specification](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures).
17
17
18
-
## Identity assertion
19
-
20
18
An identity assertion using an identity claims aggregator has this general form in JSON:
21
19
22
20
```json
@@ -53,7 +51,7 @@ An identity assertion using an identity claims aggregator has this general form
53
51
]
54
52
```
55
53
56
-
###Verified identity types
54
+
## Verified identity types
57
55
58
56
The following table describes the allowed values of the `type` property of `verifiedIdentities` array elements.
59
57
@@ -69,7 +67,7 @@ The following table describes the allowed values of the `type` property of `veri
69
67
The above table is based on the [CAWG identity assertion technical specifications](https://cawg.io/identity/1.1/#vc-credentialsubject-verifiedidentity-type).
Copy file name to clipboardExpand all lines: docs/manifest/writing/ingredients.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,11 @@ title: Writing ingredients
7
7
8
8
Digital assets are often not created entirely from scratch, but instead created from one or more existing assets, for example placing an image into a layer in Photoshop. Such constituent assets are called _ingredients_.
9
9
10
-
Old manifests may contain deprecated v1 and v2 ingredients, but applications should only write v3 ingredients.
10
+
[Old manifests](../reading/legacy.md) may contain deprecated v1 and v2 ingredients, but applications should only write v3 ingredients.
11
+
12
+
<divclass="review-comment">
13
+
This page should cover only v3 ingredients.
14
+
</div>
11
15
12
16
:::note
13
17
The C2PA Technical Specification describes _ingredient assertions_ but the CAI SDK treats ingredients separately as their own objects in the JSON manifest rather than as a type of assertion.
0 commit comments