feat: upgrade to C2PA spec v2.2 and c2patool 0.26

olgahaha · olgahaha · commit b656004b2fd9 · 2025-11-18T14:07:07.000+08:00
- Update to c2patool v0.26.1 with prebuilt binaries
- Replace stds.schema-org.CreativeWork with c2pa.metadata
- Update ingredient references to c2pa.ingredient.v3
- Add optional claim_generator_version parameter
- Support IPTC and C2PA URI formats for digitalSourceType
- Improve EXIF GPS format (degrees,minutes with direction)
- Remove unused create_custom_c2pa_manifest function

Breaking changes:
- Removed create_custom_c2pa_manifest from public API
- creator_name is now optional in create_c2pa_manifest
diff --git a/README.md b/README.md
@@ -11,8 +11,33 @@ $ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
 
 Install c2patool
 
+Download the prebuilt binary for your platform:
+
+```bash
+# For macOS (Universal Binary - Apple Silicon & Intel)
+curl -L -o c2patool.zip https://github.com/contentauth/c2pa-rs/releases/download/c2patool-v0.26.1/c2patool-v0.26.1-universal-apple-darwin.zip
+unzip c2patool.zip
+chmod +x c2patool/c2patool
+cp c2patool/c2patool ~/.local/bin/  # or any directory in your PATH
+
+# For Linux
+curl -L -o c2patool.tar.gz https://github.com/contentauth/c2pa-rs/releases/download/c2patool-v0.26.1/c2patool-v0.26.1-x86_64-unknown-linux-gnu.tar.gz
+tar -xzf c2patool.tar.gz
+chmod +x c2patool/c2patool
+cp c2patool/c2patool ~/.local/bin/
+
+# For Windows
+# Download: https://github.com/contentauth/c2pa-rs/releases/download/c2patool-v0.26.1/c2patool-v0.26.1-x86_64-pc-windows-msvc.zip
+# Extract and add c2patool.exe to your PATH
+
+# Verify installation
+c2patool --version  # Should show: c2patool 0.26.1
+```
+
+Alternatively, build from source (requires Rust):
+
 ```bash
-$ cargo install c2patool
+$ cargo install c2patool --version 0.26.1
 ```
 
 Install numbers-c2pa
diff --git a/examples/numbers-c2pa.png b/examples/numbers-c2pa.png
diff --git a/src/numbers_c2pa/__init__.py b/src/numbers_c2pa/__init__.py
@@ -1,12 +1,11 @@
-from .core import (create_c2pa_manifest, create_custom_c2pa_manifest, inject,
-                   inject_file, read_c2pa, read_c2pa_file)
+from .core import (create_c2pa_manifest, inject, inject_file, read_c2pa,
+                   read_c2pa_file)
 from .exceptions import NoClaimFound, UnknownError
 from .utils import (create_es256_private_key_file,
                     create_self_signed_certificate, generate_es256_private_key)
 
 __all__ = [
     'create_c2pa_manifest',
-    'create_custom_c2pa_manifest',
     'inject',
     'inject_file',
     'read_c2pa',
diff --git a/src/numbers_c2pa/core.py b/src/numbers_c2pa/core.py
@@ -7,7 +7,7 @@
 from datetime import datetime
 from decimal import Decimal
 from tempfile import TemporaryDirectory
-from typing import Any, Dict, List, Optional, Union
+from typing import Any, Dict, Optional, Union
 
 import requests
 
@@ -41,8 +41,17 @@ def format_datetime(date: Optional[datetime], to_timestamp=False) -> Optional[Un
     return date.strftime('%Y-%m-%dT%H:%M:%SZ')
 
 
-def format_geolocation(value: Optional[str]) -> Optional[str]:
-    return f'{Decimal(value):.12f}' if value else None
+def format_geolocation(value: Optional[str], is_latitude: bool) -> Optional[str]:
+    if not value:
+        return None
+    d = Decimal(value)
+    degrees = int(abs(d))
+    minutes = (abs(d) - degrees) * 60
+    if is_latitude:
+        direction = 'N' if d >= 0 else 'S'
+    else:
+        direction = 'E' if d >= 0 else 'W'
+    return f'{degrees},{minutes:.4f}{direction}'
 
 
 def c2patool_inject(
@@ -98,76 +107,77 @@ def create_assertion_asset_tree(
     }
 
 
-def create_assertion_creative_work(
+def create_assertion_metadata(
     nid: str,
-    creator_name: str,
     date_created: Optional[datetime] = None,
-    location_created: Optional[str] = None,
+    latitude: Optional[str] = None,
+    longitude: Optional[str] = None,
+    date_captured: Optional[datetime] = None,
 ):
-    data = {
-        '@context': 'https://schema.org',
-        '@type': 'CreativeWork',
-        'url': f'https://verify.numbersprotocol.io/asset-profile/{nid}',
-        'identifier': nid,
+    metadata = {
+        '@context': {
+            'dc': 'http://purl.org/dc/elements/1.1/',
+            'Iptc4xmpCore': 'http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/',
+            'Iptc4xmpExt': 'http://iptc.org/std/Iptc4xmpExt/2008-02-29/',
+            'exif': 'http://ns.adobe.com/exif/1.0/',
+            'exifEX': 'http://cipa.jp/exif/2.32/',
+            'tiff': 'http://ns.adobe.com/tiff/1.0/',
+            'xmp': 'http://ns.adobe.com/xap/1.0/'
+        },
+        'dc:identifier': nid,
     }
-    if creator_name:
-        data['author'] = [
-            {
-                '@type': 'Person',
-                'name': creator_name,
-            }
-        ]
     if isinstance(date_created, datetime):
-        data['dateCreated'] = date_created.strftime('%Y-%m-%dT%H:%M:%SZ')
-    if location_created:
-        data['locationCreated'] = location_created
+        metadata['dc:date'] = date_created.strftime('%Y-%m-%dT%H:%M:%SZ')
+    if latitude:
+        metadata['exif:GPSLatitude'] = format_geolocation(latitude, True)
+    if longitude:
+        metadata['exif:GPSLongitude'] = format_geolocation(longitude, False)
+    if date_captured:
+        metadata['exif:GPSTimeStamp'] = date_captured.strftime('%H:%M:%S')
+        metadata['exif:DateTimeOriginal'] = date_captured.strftime('%Y:%m:%d %H:%M:%S')
 
     return {
-        'label': 'stds.schema-org.CreativeWork',
-        'data': data
+        'label': 'c2pa.metadata',
+        'data': metadata
     }
 
 
 def create_c2pa_manifest(
     nid: str,
-    creator_name: str,
     creator_public_key: str,
     asset_hash: str,
     *,
     date_created: Optional[datetime] = None,
     latitude: Optional[str] = None,
     longitude: Optional[str] = None,
     date_captured: Optional[datetime] = None,
+    creator_name: Optional[str] = None,
     alg: str = 'es256',
     ta_url: str = 'http://timestamp.digicert.com',
     vendor: str = 'numbersprotocol',
     claim_generator_name: str = 'Numbers Protocol',
+    claim_generator_version: Optional[str] = None,
     digital_source_type: Optional[str] = None,
     generated_by: Optional[str] = None,
     asset_tree_cid: Optional[str] = None,
     asset_tree_sha256: Optional[str] = None,
     asset_tree_signature: Optional[str] = None,
     committer: Optional[str] = None,
 ):
-    location_created = (
-        f'{format_geolocation(latitude)}, {format_geolocation(longitude)}'
-        if latitude and longitude else None
-    )
+    claim_generator_info = {'name': claim_generator_name}
+    if claim_generator_version:
+        claim_generator_info['version'] = claim_generator_version
 
     manifest = {
         'alg': alg,
         'ta_url': ta_url,
         'vendor': vendor,
         'claim_generator': format_claim_generator(claim_generator_name),
-        'claim_generator_info': [
-            {
-                'name': claim_generator_name,
-            },
-        ],
+        'claim_generator_info': [claim_generator_info],
         'title': nid,
         'assertions': [
-            create_assertion_creative_work(
-                nid, creator_name, date_created, location_created,
+            create_assertion_metadata(
+                nid, date_created, latitude, longitude, date_captured,
             ),
             {
                 'label': 'c2pa.actions.v2',
@@ -186,26 +196,9 @@ def create_c2pa_manifest(
                     'publicKey': creator_public_key,
                     'mediaHash': asset_hash,
                     'captureTimestamp': format_datetime(date_captured, to_timestamp=True),
+                    **({'creatorName': creator_name} if creator_name else {}),
                 }
             },
-            {
-                'label': 'stds.exif',
-                'data': {
-                    '@context': {
-                        'EXIF': 'http://ns.adobe.com/EXIF/1.0/',
-                        'EXIFEX': 'http://cipa.jp/EXIF/2.32/',
-                        'dc': 'http://purl.org/dc/elements/1.1/',
-                        'rdf': 'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
-                        'tiff': 'http://ns.adobe.com/tiff/1.0/',
-                        'xmp': 'http://ns.adobe.com/xap/1.0/'
-                    },
-                    'EXIF:GPSLatitude': format_geolocation(latitude),
-                    'EXIF:GPSLongitude': format_geolocation(longitude),
-                    "EXIF:GPSTimeStamp": format_datetime(date_captured),
-                    'EXIF:DateTimeOriginal': format_datetime(date_captured),
-                },
-                'kind': 'Json'
-            },
         ]
     }
     if assertion_asset_tree := create_assertion_asset_tree(
@@ -215,83 +208,48 @@ def create_c2pa_manifest(
     return manifest
 
 
-def create_custom_c2pa_manifest(
-    *,
-    alg: str = 'es256',
-    ta_url: str = 'http://timestamp.digicert.com',
-    vendor: str = 'numbersprotocol',
-    claim_generator: str = 'Numbers_Protocol',
-    title: Optional[str] = None,
-    author_type: str = 'Person',
-    author_credential: Optional[List] = None,
-    author_identifier: Optional[str] = None,
-    author_name: Optional[str] = None,
-    c2pa_actions: Optional[List] = None,
-    custom_assertions: Optional[List] = None,
-):
-    manifest = {
-        'alg': alg,
-        'ta_url': ta_url,
-        'vendor': vendor,
-        'claim_generator': claim_generator,
-        'title': title,
-        'assertions': [
-            {
-                'label': 'stds.schema-org.CreativeWork',
-                'data': {
-                    '@context': 'https://schema.org',
-                    '@type': 'CreativeWork',
-                    'author': [
-                        {
-                            '@type': author_type,
-                            'credential': author_credential or [],
-                            'identifier': author_identifier,
-                            'name': author_name,
-                        }
-                    ],
-                }
-            },
-        ]
-    }
-    manifest = {k: v for k, v in manifest.items() if v is not None}
-    if c2pa_actions:
-        manifest['assertions'].append(
-            {
-                'label': 'c2pa.actions',
-                'data':
-                {
-                    'actions': c2pa_actions,
-                }
-            }
-        )
-    if custom_assertions:
-        manifest['assertions'] += custom_assertions
-    return manifest
-
-
 def create_action_c2pa_opened(
     asset_hex_hash: str,
     digital_source_type: Optional[str] = None,
     software_agent: Optional[str] = None,
 ) -> Dict[str, Any]:
+    """Create a c2pa.opened action with ingredient reference.
+
+    Args:
+        asset_hex_hash: Hex-encoded SHA256 hash of the asset
+        digital_source_type: Digital source type. Can be either:
+            - Short form: 'trainedAlgorithmicMedia' (IPTC namespace auto-prepended)
+            - Full URI: 'http://c2pa.org/digitalsourcetype/empty' (used as-is)
+        software_agent: Name of the software that created/modified the asset
+
+    Returns:
+        Action dictionary with ingredient reference for c2pa.actions.v2
+    """
     base64_hash = base64.b64encode(binascii.unhexlify(asset_hex_hash)).decode()
+
+    # Create action with ingredients reference (plural, as array)
+    # c2patool 0.26+ uses c2pa.ingredient.v3 label
     action = {
         'action': 'c2pa.opened',
         'parameters': {
             'ingredients': [
                 {
-                    'url': 'self#jumbf=c2pa.assertions/c2pa.ingredient',
+                    'url': 'self#jumbf=c2pa.assertions/c2pa.ingredient.v3',
                     'alg': 'sha256',
                     'hash': base64_hash,
                 },
             ],
         },
     }
     if digital_source_type:
-        action['digitalSourceType'] = (
-            'http://cv.iptc.org/newscodes/digitalsourcetype/'
-            f'{digital_source_type}'
-        )
+        # If full URI provided, use as-is; otherwise prepend IPTC namespace
+        if digital_source_type.startswith('http://'):
+            action['digitalSourceType'] = digital_source_type
+        else:
+            action['digitalSourceType'] = (
+                'http://cv.iptc.org/newscodes/digitalsourcetype/'
+                f'{digital_source_type}'
+            )
     if software_agent:
         action['softwareAgent'] = {
             'name': software_agent,
