Skip to content

Commit a90563d

Browse files
crandmckcrandmck
authored
Merge branch 'main' into manifest-tasks
2 parents ddd71f1 + b650aaf commit a90563d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

70 files changed

+12718
-6270
lines changed

‎.github/workflows/build-deploy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ on:
99
types: [opened, synchronize]
1010
jobs:
1111
build-deploy:
12-
runs-on: ubuntu-20.04
12+
runs-on: ubuntu-24.04
1313
defaults:
1414
run:
1515
working-directory: site

‎.gitignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
# Generated files
88
.docusaurus
99
.cache-loader
10+
11+
# External files loaded by fetch-readmes script
1012
/docs/js-sdk/api
1113
/docs/js-sdk/examples/*
1214
/docs/js-sdk/examples/*
@@ -22,6 +24,13 @@
2224
/docs/rust-sdk/*.md
2325
/docs/rust-sdk/docs/*.md
2426
/docs/**/readme.md
27+
/static/sb-alg-list.json
28+
/docs/trustmark/*.md
29+
/docs/trustmark/c2pa/*.md
30+
/docs/trustmark/js/*.md
31+
/docs/trustmark/python/*.md
32+
/docs/trustmark/rust/*.md
33+
/docs/trustmark/rust/crates/trustmark-cli/*.md
2534

2635
# Misc
2736
.DS_Store

‎docs/c2pa-js/.gitkeep‎

Whitespace-only changes.

‎docs/community.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,25 @@ We also welcome thoughtful pull requests (PRs) from the community, following the
2929

3030
Participants are required to follow the [Adobe Code of Conduct](https://github.com/contentauth/c2pa-rs/blob/main/CODE_OF_CONDUCT.md) to maintain an open and welcoming environment for all.
3131

32+
### Incubator projects
33+
34+
:::warning Warning
35+
Incubator projects are still under active development and are not yet ready for general use. However, input and bug reports are welcome in the GitHub repositories.
36+
:::
37+
38+
These projects are in early alpha release:
39+
- [iOS Library](https://github.com/contentauth/c2pa-ios): Provides iOS/macOS support via Swift Package/XCFramework.
40+
- [Android Library](https://github.com/contentauth/c2pa-android): Provides native Android support via an AAR library.
41+
42+
Both of these projects wrap the C2PA Rust implementation ([c2pa-rs](https://github.com/contentauth/c2pa-rs)) using its C API bindings.
43+
3244
### Related projects
3345

3446
These related projects may be of interest, but the CAI team doesn't maintain or support them:
3547

3648
- [**Drupal module**](https://github.com/contentauth/c2pa-drupal): Enables Drupal sites to process and display Content Credentials for supported image types.
3749
- [**DASH video player**](https://github.com/contentauth/dash.js/tree/c2pa-dash): DASH video player that displays Content Credentials in browsers for supported media types. This repo/branch is a work-in-progress forked from [dash.js](https://github.com/Dash-Industry-Forum/dash.js), the canonical reference JavaScript implementation for the playback of MPEG DASH.
38-
- [**TrustMark**](https://github.com/adobe/trustmark): Open-source Python implementation of watermarking for encoding, decoding and removing image watermarks.
50+
- [**TrustMark**](https://github.com/adobe/trustmark): Open-source Python implementation of watermarking for encoding, decoding and removing image watermarks. You can use TrustMark as part of providing [durable content credentials](durable-cr/index.md).
3951
- [**C2PA Security Testing Tool**](https://github.com/contentauth/c2pa-attacks): A CLI tool derived from [c2patool](https://github.com/contentauth/c2patool) that performs security testing on a Content Credentials application. This tool is intended for use by software security professionals.
4052

4153
## Discussions on Discord

‎docs/conformance.mdx‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
id: conformance
3+
title: C2PA conformance program
4+
---
5+
6+
The [C2PA conformance program](https://c2pa.org/conformance) was launched in mid-2025 to help ensure that products that read and create Content Credentials are compliant with the C2PA Content Credentials specification.
7+
8+
The C2PA conformance program covers:
9+
10+
- [Validator products](#validator-products) that read and validate Content Credentials.
11+
- [Generator products](#generator-products) that create Content Credentials and add them to a digital asset.
12+
- [Certificate authorities (CAs)](#certificate-authorities).
13+
14+
:::info
15+
If you're developing a product that reads or creates Content Credentials, you can apply for the C2PA conformance program. If accepted, the product is added to the [conforming products list](https://github.com/c2pa-org/conformance-public/blob/main/conforming-products/conforming-products-list.json#L302), which indicates it is compliant with the C2PA Content Credentials specification.
16+
17+
**To start the process, fill out C2PA's [expression of interest form](https://docs.google.com/forms/d/e/1FAIpQLScERZH5rKfoeSu3y6gGbkllkyeAhmF0G-kXS0eXpb2vR238Rg/viewform).**
18+
:::
19+
20+
When you apply to the conformance program, you will:
21+
22+
- Sign a legal agreement with the C2PA.
23+
- Provide evidence supporting your application such as diagrams and documentation.
24+
- Work with the conformance program staff to resolve any questions.
25+
26+
## Products
27+
28+
### Validator products
29+
30+
A _validator product_ can read and validate a manifest store for a digital asset.
31+
A conforming validator product produces correct validation results according to the C2PA Content Credentials specification.
32+
33+
For more information, see [C2PA Conformance Program Documents](https://github.com/c2pa-org/conformance-public/tree/main/docs/current), specifically
34+
[C2PA conformance program - section 6.1.1, Validator Product Specification Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Conformance%20Program.pdf).
35+
36+
### Generator products
37+
38+
A _generator product_ can generate manifest data for a digital asset. A conforming generator product produces manifest data that conforms to the C2PA Content Credentials specification, creates assertions in the asset's active manifest and signs a claim using a valid X.509 certificate on the C2PA trust list.
39+
40+
For more information, see [C2PA Conformance Program Documents](https://github.com/c2pa-org/conformance-public/tree/main/docs/current), specifically:
41+
42+
- [C2PA conformance program - section 6.1.1, Generator Product Specification Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Conformance%20Program.pdf)
43+
- [C2PA Generator Product Security
44+
Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Generator%20Product%20Security%20Requirements.pdf)
45+
46+
#### Preliminary certificate check
47+
48+
To confirm all the settings in your signing certificate, you can follow the [preliminary certificate check](trust-list.mdx#checking-your-certificate) for the interim trust list to help ensure everything is as expected.
49+
50+
#### Security requirements
51+
52+
When you apply to the conformance program, you must fill out the information required in the **product security architecture template** in Appendix C of the [C2PA Generator Product Security
53+
Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Generator%20Product%20Security%20Requirements.pdf), providing details on:
54+
55+
- The organization submitting the application.
56+
- The product, its capabilities, and the systems it uses or relies upon.
57+
- The product's security architecture, including methods for key generation and storage, and protections against various kinds of misconfiguration, abuse, and exploitations.
58+
59+
### Assurance levels
60+
61+
A conforming product's _assurance level_ indicates the level of confidence that claims it signs reflect its intended behavior. A higher assurance level indicates a greater level of confidence. Currently, the conformance program has two assurance levels: level 1 and level 2:
62+
63+
- [C2PA Generator Product Security
64+
Requirements](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Generator%20Product%20Security%20Requirements.pdf) details the security requirements for each assurance level.
65+
- [C2PA certificate policy - Appendix A](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Certificate%20Policy.pdf) details the requirements for claim signing certificates for each assurance level.
66+
67+
The assurance level is encoded as the value of a custom X.509 v3 certificate extension in the product's claim signing certificate. The C2PA defines the _max assurance level_ of a generator product based on the security attributes of its overall implementation architecture. The assurance level in the certificate issued to a particular instance of a conforming generator product may be lower than the max assurance level.
68+
69+
## Certificate authorities
70+
71+
The [C2PA certificate policy](https://github.com/c2pa-org/conformance-public/blob/main/docs/current/C2PA%20Certificate%20Policy.pdf) specifies requirements for certificate authorities (CAs) that issue claim signing certificates for use by generator products, and the requirements that those products have to meet when using the certificates.
72+
73+
CAs on the C2PA trust list can issue certificates to conforming generator products under the C2PA conformance program.
74+
75+
## C2PA trust lists
76+
77+
C2PA maintains two trust lists:
78+
79+
- [**C2PA trust list**](https://github.com/c2pa-org/conformance-public/blob/main/trust-list/C2PA-TRUST-LIST.pem): A list of X.509 certificate trust anchors (either root or subordinate certification authorities) that issue certificates to conforming generator products under the C2PA Certificate Policy.
80+
- [**C2PA time-stamping authority (TSA) trust list**](https://github.com/c2pa-org/conformance-public/blob/main/trust-list/C2PA-TSA-TRUST-LIST.pem): A list of X.509 certificate trust anchors (either root or subordinate certification authorities) that issue time-stamp signing certificates to TSAs.
81+
82+
### Interim trust list retirement
83+
84+
With the introduction of the C2PA trust list, the existing [interim (temporary) trust list](trust-list.mdx) is being retired on the following timeline:
85+
86+
- **Through December 31, 2025**: The [interim trust list](trust-list.mdx) will remain operational. During this time:
87+
- The [Verify site](https://contentcredentials.org/verify) will continue to display manifests signed by certificates on the interim trust list as trusted, but with a disclaimer that the manifests were made with an older version of the trust model.
88+
- New certificates will continue to be added to the interim trust list when requested.
89+
- Product developers are strongly encouraged to apply to the C2PA conformance program and use the official C2PA trust list.
90+
- **On January 1, 2026**: The interim trust list will be frozen:
91+
- No new certificates will be added to the list, and no updates will be made.
92+
- Existing certificates will remain valid for legacy support.
93+
94+
Eventually, the certificates on the interim trust list will expire and will not be usable for signing. However, if content was signed during the certificate's validity period, the content will always be considered valid against the legacy trust model.
95+
96+
Validator products are encouraged to begin distinguishing between Content Credentials signed with certificates on the interim trust list (typically tied to Content Credentials specification version version 1.4) and those from conforming products using the official C2PA trust list.

‎docs/durable-cr/index.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
id: index
3+
title: Durable Content Credentials
4+
---
5+
6+
[_Durable Content Credentials_](https://contentauthenticity.org/blog/durable-content-credentials) is a concept that helps content provenance to persist across content platforms by using C2PA manifest data in conjunction with:
7+
8+
- **Invisible watermarks**, actively inserted into the content.
9+
- **Content fingerprints**, passively computed from the content.
10+
11+
Platforms that host media assets might remove C2PA manifest data, if, for example, they use software that does not yet support the standard. If a copy of the manifest data is stored in an online database, you can use a watermark or a fingerprint to find it again.
12+
Combining both watermarks and fingerprints further improves the robustness of the provenance information.
13+
14+
The C2PA specification refers to watermarking and content fingerprinting as [soft bindings](https://c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html#_soft_bindings), and requires that they be generated using one of the approved [Watermarking and fingerprinting algorithms](soft-bindings.mdx).

‎docs/durable-cr/soft-bindings.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
id: sb-algs
3+
title: Watermarking and fingerprinting algorithms
4+
hide_table_of_contents: true
5+
---
6+
7+
The C2PA specification refers to watermarking and content fingerprinting as [soft bindings](https://c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html#_soft_bindings), which can be used to find digital content, even if the underlying bits differ. The C2PA specification requires that soft bindings be generated using one of the [algorithms](https://c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html#_soft_binding_algorithm_list) approved by the C2PA Technical Working Group.
8+
9+
:::note
10+
The table below is provided **for convenience only** and is created and automatically updated based on data from the [C2PA Soft Binding Algorithm List](https://github.com/c2pa-org/softbinding-algorithm-list/blob/main/softbinding-algorithm-list.json), which is the single authoritative source of the information.
11+
:::
12+
13+
import JSONToTable from '@site/src/components/JSONToTable';
14+
15+
<JSONToTable />

‎docs/durable-cr/trustmark-faq.mdx‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
id: tm-faq
3+
title: TrustMark FAQ
4+
hide_table_of_contents: true
5+
---
6+
7+
- [General Usage and Adoption](#general-usage-and-adoption)
8+
- [What is TrustMark?](#what-is-trustmark)
9+
- [How does TrustMark compare to traditional visible watermarks?](#how-does-trustmark-compare-to-traditional-visible-watermarks)
10+
- [What is this software?](#what-is-this-software)
11+
- [Can I integrate TrustMark into my own application?](#can-i-integrate-trustmark-into-my-own-application)
12+
- [Can I use TrustMark in commercial projects?](#can-i-use-trustmark-in-commercial-projects)
13+
- [Why would I want to make an image identifiable using TrustMark?](#why-would-i-want-to-make-an-image-identifiable-using-trustmark)
14+
- [Can TrustMark be embedded in any images, including those generated by AI?](#can-trustmark-be-embedded-in-any-images-including-those-generated-by-ai)
15+
- [How does TrustMark align with provenance standards such as the C2PA?](#how-does-trustmark-align-with-provenance-standards-such-as-the-c2pa)
16+
- [Does TrustMark alter metadata or EXIF information?](#does-trustmark-alter-metadata-or-exif-information)
17+
- [Technical Details](#technical-details)
18+
- [Does TrustMark support my image format?](#does-trustmark-support-my-image-format)
19+
- [Does TrustMark work on grayscale images?](#does-trustmark-work-on-grayscale-images)
20+
- [How fast is TrustMark?](#how-fast-is-trustmark)
21+
- [What are the image resolution limits of TrustMark?](#what-are-the-image-resolution-limits-of-trustmark)
22+
- [How robust is TrustMark?](#how-robust-is-trustmark)
23+
- [Can I print TrustMark?](#can-i-print-trustmark)
24+
- [Can TrustMark be embedded in vector graphics?](#can-trustmark-be-embedded-in-vector-graphics)
25+
- [What dataset was TrustMark trained on?](#what-dataset-was-trustmark-trained-on)
26+
- [What happens if I apply TrustMark to an already watermarked image?](#what-happens-if-i-apply-trustmark-to-an-already-watermarked-image)
27+
- [How does TrustMark compare to State of the Art Watermarking approaches](#how-does-trustmark-compare-to-state-of-the-art-watermarking-approaches)
28+
- [Can TrustMark co-exist with other watermarks?](#can-trustmark-co-exist-with-other-watermarks)
29+
- [Configuration](#configuration)
30+
- [Which variant of TrustMark should I use?](#which-variant-of-trustmark-should-i-use)
31+
- [How can I trade off between robustness and capacity?](#how-can-i-trade-off-between-robustness-and-capacity)
32+
- [How can I trade off between robustness and quality?](#how-can-i-trade-off-between-robustness-and-quality)
33+
- [Can I control where the watermark is embedded in an image?](#can-i-control-where-the-watermark-is-embedded-in-an-image)
34+
- [Does TrustMark affect the file size of an image?](#does-trustmark-affect-the-file-size-of-an-image)
35+
- [Security and Privacy](#security-and-privacy)
36+
- [Can TrustMark be removed?](#can-trustmark-be-removed)
37+
- [Can TrustMark be used to track users or infringe on privacy?](#can-trustmark-be-used-to-track-users-or-infringe-on-privacy)
38+
- [Can TrustMark be used to secretly mark images without user consent?](#can-trustmark-be-used-to-secretly-mark-images-without-user-consent)
39+
- [Is TrustMark steganographic watermarking?](#is-trustmark-steganographic-watermarking)
40+
- [Why release removal code?](#why-release-removal-code)
41+
- [Does TrustMark interfere with other AI or image processing tasks like object detection?](#does-trustmark-interfere-with-other-ai-or-image-processing-tasks-like-object-detection)
42+
- [Can TrustMark be used to detect image manipulation?](#can-trustmark-be-used-to-detect-image-manipulation)
43+
- [Can TrustMark be transferred from one image to another?](#can-trustmark-be-transferred-from-one-image-to-another)
44+
- [What stops someone from spoofing a TrustMark?](#what-stops-someone-from-spoofing-a-trustmark)
45+
- [Future Developments](#future-developments)
46+
- [Will TrustMark support other media types like video?](#will-trustmark-support-other-media-types-like-video)
47+
- [Is TrustMark compatible with blockchain technology?](#is-trustmark-compatible-with-blockchain-technology)
48+
- [Can TrustMark be used for NFT provenance?](#can-trustmark-be-used-for-nft-provenance)
49+
50+
import Faq from '../trustmark/FAQ.md';
51+
52+
<Faq name="faq" />

‎docs/durable-cr/trustmark-intro.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
id: trustmark-intro
3+
title: TrustMark watermarking
4+
---
5+
6+
TrustMark is an open-source universal watermarking system for images that:
7+
8+
- Can encode, decode, and remove watermarks from images.
9+
- Works with arbitrary resolution images.
10+
- Has implementations in Python (using PyTorch), [Rust](trustmark/rust/README.md), and [JavaScript](trustmark/js/README.md) (both using ONNX).
11+
12+
:::info
13+
For full technical details and help getting started with TrustMark, see [TrustMark - Overview](trustmark/README.md).
14+
:::
15+
16+
## Variants
17+
18+
TrustMark has three primary model variants, each with different characteristics.
19+
20+
Images encoded with one variant cannot be decoded with another variant, so you need to stick with the same variant throughout your pipeline.
21+
22+
- **Variant Q (Default)** Use in most cases, where you want a good balance between robustness and imperceptibility. PSNR is 43-45 dB.
23+
- **Variant P** - Use when image quality is the top priority. PSNR is 48-50 dB.
24+
- **Variant C (Compact)** - Use if you need to minimize model size and can live with slightly lower visual quality. PSNR is 38-39 dB.
25+
26+
The general recommendation is to use either:
27+
- Variant Q for most use cases.
28+
- Variant P when visual quality is paramount.
29+
30+
## About PSNR
31+
32+
PSNR (Peak Signal-to-Noise Ratio) is a measure of image quality when comparing an original image to the watermarked image. PSNR is measured in decibels (dB), with higher values indicating better quality:
33+
- Values around 45+ dB typically indicate very good quality.
34+
- Values around 40 dB indicate acceptable quality.
35+
- Values below 30 dB indicate poor quality, unacceptable for most uses.
36+

0 commit comments

Comments
 (0)