You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/community.md
+14-8Lines changed: 14 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,28 +7,30 @@ The Content Authenticity Initiative has an active and growing community of devel
7
7
8
8
## GitHub
9
9
10
-
All the open-source CAI code is hosted in GitHub in the [CAI GitHub organization](https://github.com/contentauth) and we welcome input in the form of issues and pull requests in the repositories:
10
+
All the open-source CAI code is hosted in GitHub in the [CAI GitHub organization](https://github.com/contentauth):
If you think you've found a bug or want to request a feature, please open an issue in the appropriate repository.
22
20
23
21
:::note
24
-
Do not create a public GitHub issue for suspected security vulnerabilities. Instead, please file an issue through [Adobe's HackerOne page](https://hackerone.com/adobe?type=team).
22
+
Do not create a public GitHub issue for **suspected security vulnerabilities**. Instead, please file an issue through [Adobe's HackerOne page](https://hackerone.com/adobe?type=team).
25
23
For more information on reporting security issues, see [SECURITY.md](https://github.com/contentauth/c2pa-rs/blob/main/SECURITY.md).
26
24
:::
27
25
28
26
We also welcome thoughtful pull requests (PRs) from the community, following the contribution guidelines provided out in each repository. The guidelines are generally the same for all the SDK repositories; for example. see the [c2pa-rs contribution guidelines](https://github.com/contentauth/c2pa-rs/blob/main/CONTRIBUTING.md).
29
27
30
28
Participants are required to follow the [Adobe Code of Conduct](https://github.com/contentauth/c2pa-rs/blob/main/CODE_OF_CONDUCT.md) to maintain an open and welcoming environment for all.
31
29
30
+
### Verify
31
+
32
+
The code for the [C2PA Verify website](https://verify.contentauthenticity.org/) is open source. For general information on using it, see [Using the Verify tool](verify.mdx).
33
+
32
34
### Related projects
33
35
34
36
These related projects may be of interest, but the CAI team doesn't maintain or support them:
@@ -38,6 +40,10 @@ These related projects may be of interest, but the CAI team doesn't maintain or
38
40
-[**TrustMark**](https://github.com/adobe/trustmark): Open-source Python implementation of watermarking for encoding, decoding and removing image watermarks. You can use TrustMark as part of providing [durable content credentials](durable-cr/index.md).
39
41
-[**C2PA Security Testing Tool**](https://github.com/contentauth/c2pa-attacks): A CLI tool derived from [c2patool](https://github.com/contentauth/c2patool) that performs security testing on a Content Credentials application. This tool is intended for use by software security professionals.
40
42
43
+
## Browser extension
44
+
45
+
The free [browser extension for Google Chrome](https://chromewebstore.google.com/detail/c2pa-content-credentials/mjkaocdlpjmphfkjndocehcdhbigaafp?hl=en) enables you to verify and display manifests for images, audio and videos which have C2PA Content Credentials.
46
+
41
47
## Discussions on Discord
42
48
43
49
The CAI maintains a [Discord server](https://discord.gg/CAI) for open technical discussions within the developer community, with channels focused on different projects and topics.
The C2PA [Verify tool](https://verify.contentauthenticity.org) uses a list of _known certificates_ (sometimes referred to as a "trust list") to determine whether a Content Credential was issued by a known source. The known certificate list applies only to [Verify](https://verify.contentauthenticity.org). For more information, see [Verify tool known certificate list](verify-known-cert-list)
97
+
The C2PA [Verify tool](https://verify.contentauthenticity.org) uses a list of _known certificates_ (sometimes referred to as a "trust list") to determine whether a Content Credential was issued by a known source. Currently, it uses the [interim trust list](verify-known-cert-list) but it will be updated soon to use the official [C2PA trust list](conformance.mdx#c2pa-trust-lists).
98
98
99
99
## Identity
100
100
101
-
To identify who created or modified an asset, identity needs to be verifiable and bound to an asset and its manifest store. The CAI SDK supports the [W3C verifiable credentials](https://c2pa.org/specifications/specifications/1.4/specs/C2PA_Specification.html#_w3c_verifiable_credentials) standard recommendation (part of the C2PA v1.4 specification), but doesn't currently have a way to validate these credentials or ensure that they properly reflect authorship of the content. An actor can add one or more identities to a manifest using the W3C verifiable credentials data model. Currently, a verifier must trust the manifest signer to properly authenticate the identity.
102
-
103
-
Identity can be bolstered with other kinds of evidence such as _Adobe connected accounts_. In the future, the identity credentials will be separately verifiable. In the future, these verifiable credentials will be strongly bound to the manifest and media and be independently verifiable.
104
-
105
-
In addition to simply adding a name and organization, Adobe tools can use the [Connected Accounts service](https://connected-accounts.adobe.com/) to connect social media accounts such as Behance, Instagram, or Twitter to an identity in a manifest. This service uses OAuth, so a user must be able to log in to the account to connect it.
101
+
To identify who created or modified an asset, identity needs to be verifiable and bound to an asset and its manifest store.
106
102
107
103
:::info
108
-
The [Creator Assertions Working Group (CAWG)](https://creator-assertions.github.io/)is developing a technical specification for an identity assertion for use in the C2PA ecosystem. CAI expects to adopt and implement this specification in the SDK at some point in the future.
104
+
The [Creator Assertions Working Group (CAWG)](https://creator-assertions.github.io/)provides a technical specification for an identity assertion for use in the C2PA ecosystem. For more information, see [Reading CAWG identity assertions](manifest/reading/reading-cawg-id.md).
109
105
:::
110
106
107
+
In addition, Adobe tools can use the [Connected Accounts service](https://connected-accounts.adobe.com/) to connect social media accounts such as Behance, Instagram, or Twitter to an identity in a manifest. This service uses OAuth, so a user must be able to log in to an Adobe account to connect it.
108
+
111
109
## How to use the SDK
112
110
113
111
The CAI open-source SDK consist of:
114
112
115
-
-**C2PA Tool**, a command-line tool for working with manifests and media. This tool is a wrapper around the Rust SDK and provides most of the same capabilities that it does.
116
-
-**Language-specific libraries** in C/C++, Python, Node.js and client JavaScript. NOTE: The C/C++, Python, Node.js libraries are prerelease versions whose APIs are subject to change.
117
-
-**The Rust library** enables a desktop, mobile, or embedded application to create and sign manifests, embed manifests in certain file formats, and parse and validate manifests.
113
+
-[**C2PA Tool**](c2patool/readme.md), a command-line tool for working with manifests and media. This tool is a wrapper around the Rust SDK and provides most of the same capabilities that it does.
114
+
-[**JavaScript library**](c2pa-js) that enables web pages to verify and read manifest data using client JavaScript.
115
+
-**[C/C++](c2pa-c/readme.md), [Python](c2pa-python/readme.md), [Node.js](c2pa-node/readme.md) libraries** that enable applications to read and validate manifest data, create and sign manifest data and embed it supported asset files.
116
+
-[**Mobile libraries**](mobile.md) that enable mobile applications for iOS and Android to to read and generate manifest data.
117
+
-[**The Rust library**](rust-sdk/readme.md) that generates the other language bindings and can also be used directly to read and generate manifest data.
118
118
119
-
Behind the scenes, C2PA Tool and language-specific libraries are built using the Rust library to ensure consistency.
119
+
C2PA Tool and language-specific libraries are built using the Rust library to ensure consistency.
120
120
121
121
The following diagram provides a high-level view of how to use the open-source CAI SDK.
122
122
@@ -125,36 +125,22 @@ The following diagram provides a high-level view of how to use the open-source C
125
125
Applications can use the CAI SDK in several different ways:
126
126
127
127
- Web pages can use the JavaScript library to display Content Credentials.
128
-
- Applications can "shell out" to call C2PA Tool directly.
129
-
- Applications written in C++, Python, or Node.js can use the APIs of the corresponding language libraries to:
128
+
- Applications can "shell out" to call C2PA Tool directly, though doing so is not highly scalable.
129
+
- Applications written in C++, Python, or Node.js can use the corresponding language libraries to:
130
130
- Create, modify, and sign manifests.
131
131
- Embed manifests into media files.
132
132
- Parse and validate manifests.
133
+
- Mobile apps can use the iOS and Android libraries do all the above.
133
134
134
-
Similarly, applications written in many programming languages can use the Rust Foreign Function Interface to call the Rust API and perform those same functions.
135
-
136
-
### Native desktop or mobile applications
137
-
138
-
Applications written in C++, Python, or Node.js can use the corresponding prerelease library APIs. Applications written in any language call C2PA Tool directly, though doing so is not highly scalable.
139
-
140
-
Alternatively, native applications can use Rust's _Foreign Function Interface_ (FFI) to call functions in the Rust library. The FFI enables interoperability between Rust and code written in other languages.
141
-
142
-
Although the underlying technology of the Rust library supports all major programming languages, the bindings and APIs to make all of them workable and easy to use are still in development.
143
-
144
-
A Windows application can use the FFI to call Rust functions from languages such as C++ or C#. For an example, see the [c2c2pa repository](https://github.com/contentauth/c2c2pa).
145
-
146
-
An Android application can use JNI (Java Native Interface) to call Rust functions from Java or Kotlin code. This requires creating a shared library (a .so file) with Rust code that exposes functions with `#[no_mangle]` attribute and an `extern "C"` keyword. Java and Kotlin code can load and invoke the shared library using `System.loadLibrary()` and native methods.
147
-
148
-
An iOS application can use the C-ABI (C Application Binary Interface) to call Rust functions from Swift or Objective-C code. This also requires creating a shared library (a .dylib file) with Rust code that exposes functions with `#[no_mangle]` attribute and `extern "C"` keyword. For a simple example, see [`lib.rs` in the c2c2pa repository](https://github.com/contentauth/c2c2pa/blob/main/src/lib.rs). Swift or Objective-C code can link and invoke the shared library using the `@_silgen_name` attribute and unsafe blocks.
135
+
Alternatively, native applications can use Rust's _Foreign Function Interface_ (FFI) to call functions in the Rust library. The FFI enables interoperability between Rust and code written in other languages. For example, a Windows application can use the FFI to call Rust functions from languages such as C++ or C#. For an example, see the [c2c2pa repository](https://github.com/contentauth/c2c2pa).
149
136
150
137
### Websites
151
138
152
-
A website can serve web pages that use the JavaScript library to display manifest data using client JavaScript. The ability to create and sign manifests from JavaScript via [WebAssembly](https://webassembly.org/) is under consideration and may be released in the future.
153
-
139
+
A website can serve web pages that use the JavaScript library to display manifest data using client JavaScript.
154
140
A server-side web application can create, modify, and sign claims (and view them) by:
155
141
156
142
- Executing a shell command to invoke C2PA Tool. For an example, see the [c2patool Node.js service example](c2pa-service-example). While this approach works, it is not highly scalable.
157
-
- Use the prerelease [Node.js](c2pa-node), [Python](c2pa-python), or [C++/C](c2pa-c) libraries.
143
+
- Use the [Node.js](c2pa-node), [Python](c2pa-python), or [C++/C](c2pa-c) libraries.
158
144
- Bind to the Rust library and use it, similarly to native applications.
You're strongly encouraged to read this introduction and [Getting started](getting-started.mdx) to give you some basic background and context, before you dive right into development. [Working with manifests](manifest/understanding.md) also has some crucial information, regardless of which language and library you use.
@@ -37,20 +37,16 @@ To see a summary of what each tool and library can do, see [Which tool is right
37
37
38
38
### JavaScript library
39
39
40
-
The client [JavaScript library](js-sdk/getting-started/overview.mdx) enables **working with manifest data in the browser**. Use this library to:
40
+
The client [JavaScript library](js-sdk/js-landing.md) enables **working with manifest data in the browser**. Use this library to:
41
41
42
42
- Verify and display manifest data on a website or web application.
43
43
- Link manifest data displayed on your site to [Verify](https://verify.contentauthenticity.org/).
44
44
- Easily add user interface elements to your website that display manifest data while following the [C2PA user experience recommendations](https://c2pa.org/specifications/specifications/1.0/ux/UX_Recommendations.html).
45
45
46
-
### Prerelease libraries
46
+
### Other language libraries
47
47
48
48
The [C++/C](c2pa-c/readme.md), [Python](c2pa-python/readme.md), and [Node.js](c2pa-node/readme.md) libraries enable applications written in those languages to **create, verify, and display Content Credentials**.
49
49
50
-
:::warning Warning
51
-
These libraries are all early prerelease versions. They may have bugs and unimplemented features, and their APIs are subject to change.
52
-
:::
53
-
54
50
### Rust library
55
51
56
52
The [Rust library](rust-sdk/readme.md) enables **adding C2PA capabilities to a desktop, mobile, or embedded application**. The Rust library is the fundamental system underlying everything else. C2PA Tool uses it "under the hood" and language-specific APIs are generated from it.
Copy file name to clipboardExpand all lines: docs/manifest/reading/validation.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,9 +39,7 @@ Manifest validation errors can occur, for example, when:
39
39
40
40
## Validation errors in ingredients
41
41
42
-
Ingredients are validated when they are imported into an asset and the result is stored in the ingredient's `validation_results` object.
43
-
44
-
Only errors that are not already recorded in the `validation_status` of an ingredient are reported. See [ValidationStatus](./json-ref/manifest-def.mdx#validationstatus) object in Manifest store reference.
42
+
Ingredients are validated when they are imported into an asset and the result is stored in the [ValidationResults](./manifest/json-ref/reader#validationresults) object.
Copy file name to clipboardExpand all lines: docs/verify.mdx
+9-1Lines changed: 9 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -56,6 +56,14 @@ To use Verify on an asset URL, the URL must not require any authentication and t
56
56
57
57
The [example-assets](https://contentauth.github.io/example-assets/) repository contains some sample assets that demonstrate Content Credentials, including links to view the corresponding manifest reports from the [C2PA Tool](c2patool) and to inspect the assets using Verify. See [the README as rendered in GitHub Pages](https://contentauth.github.io/example-assets/).
58
58
59
+
### Source code
60
+
61
+
The code for the Verify site is open source and is available at <https://github.com/contentauth/verify-site/>.
0 commit comments