@rolobits/attestation-photo-mobile

Hardware-attested photo capture for React Native with embedded C2PA manifests.

Every photo taken through this SDK is signed by the device's tamper-resistant hardware, Secure Enclave on iOS and StrongBox/TEE on Android, and embedded with a C2PA manifest before the file is ever written to disk. The resulting JPEG can be verified with any standard C2PA tool.

Install

1. npm

npm install @rolobits/attestation-photo-mobile

Peer dependency	Version
react	>= 18
react-native	>= 0.73

2. Rust toolchain, one-time setup

# Install Rust (if not already installed)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# Add mobile targets
rustup target add aarch64-apple-ios        # iOS device
rustup target add aarch64-apple-ios-sim    # iOS simulator (Apple Silicon)
rustup target add aarch64-linux-android    # Android

# Android builds require cargo-ndk
cargo install cargo-ndk

3. iOS

The Rust static library is compiled automatically via a CocoaPods script phase. No manual Xcode linking required.

cd ios && pod install

4. Android

The Rust shared library is compiled automatically via a Gradle task. Just build your app as usual.

5. Permissions

Permission	iOS Info.plist	Android AndroidManifest.xml	Required?
Camera	NSCameraUsageDescription	android.permission.CAMERA	Yes
Location	NSLocationWhenInUseUsageDescription	android.permission.ACCESS_FINE_LOCATION	Only with includeLocation: true

Quick start

This library is headless, it handles attestation and signing, you bring your own camera (react-native-vision-camera, expo-camera, or anything that produces a JPEG path). See the example app for a full implementation.

import { useRef, useCallback } from "react";
import { Camera, useCameraDevice, useCameraPermission } from "react-native-vision-camera";
import { useAttestedCapture, saveToGallery } from "@rolobits/attestation-photo-mobile";

function CaptureScreen() {
  const cameraRef = useRef<Camera>(null);
  const device = useCameraDevice("back");
  const { hasPermission, requestPermission } = useCameraPermission();

  const { signPhoto, status, isReady } = useAttestedCapture({
    includeLocation: true,               // embed GPS in the C2PA manifest
    appName: "My App",                   // shown in Content Credentials
    nonce: "server-challenge-token",     // replay prevention
  });

  const onPressCapture = useCallback(async () => {
    // 1. Take a photo with VisionCamera
    const rawPhoto = await cameraRef.current!.takePhoto();

    // 2. Sign & embed the C2PA manifest — that's it
    const signed = await signPhoto(rawPhoto.path);

    // 3. (Optional) save to gallery
    await saveToGallery({ filePath: signed.path });
  }, [signPhoto]);

  return <Camera ref={cameraRef} device={device!} isActive photo />;
}

useAttestedCapture handles everything behind the scenes: hardware key provisioning, device integrity checks, location prefetch & refresh, file:// prefix stripping, and error wrapping into typed AttestedCameraError codes.

useAttestedCapture options

Option	Type	Default	Description
includeLocation	boolean	false	Embed GPS coordinates in the C2PA manifest.
requireTrustedHardware	boolean	true	Reject signing on devices without Secure Enclave / StrongBox / TEE.
appName	string	"Attestation Mobile"	App name shown in C2PA Content Credentials.
nonce	string	—	Server challenge token for replay prevention.

useAttestedCapture return value

Property	Type	Description
signPhoto	(photoPath: string) => Promise<SignedPhoto>	Sign a photo at the given path. Strips file:// prefix automatically. Rejects with AttestedCameraError on trust or signing failures.
status	AttestationStatus | null	Current attestation status (null while loading on mount).
isReady	boolean	true once key provisioning and status check have completed.

Lower-level functions

For advanced use cases where you need full control over each step, every function the hook uses is also exported individually:

Function	Returns	Description
getAttestationStatus()	Promise<AttestationStatus>	Check device integrity and hardware trust level.
ensureHardwareKey()	Promise<{ trustLevel }>	Provision the hardware-backed signing key. Idempotent.
captureAndSignAtomic(params)	Promise<SignedPhoto>	Hash, sign, and embed a C2PA manifest into a JPEG.
saveToGallery(params)	Promise<{ uri }>	Save a file to the device photo gallery.
hashPhotoAtPath(params)	Promise<{ sha256Hex }>	Compute the SHA-256 hash of a photo file.
signPayload(params)	Promise<{ signatureBase64, trustLevel }>	Sign arbitrary base64 data with the hardware key.
prefetchLocation()	Promise<{ latitude, longitude } | null>	Pre-fetch GPS location in background for faster captures.

SignedPhoto

The object returned by captureAndSignAtomic():

interface SignedPhoto {
  path: string;                    // File path to the signed JPEG
  signature: string;               // SHA-256 hex of the original asset
  algorithm: "ECDSA_P256_SHA256";  // Signing algorithm used
  manifestFormat: "c2pa-jumbf";    // Always JUMBF
  trustLevel: PlatformTrustLevel;  // "secure_enclave" | "strongbox" | "tee" | "software_fallback"
  embeddedManifest?: boolean;      // true when real C2PA manifest is embedded
  metadata: CaptureMetadata;       // Device model, OS, timestamp, nonce, etc.
}

Verifying output

Upload the output JPEG to verify.contentauthenticity.org or use the CLI:

cargo install c2patool
c2patool verify output.jpg

The verifier will show a valid signature with an unknown signer. This is expected for self-signed certificates. See Limitations below.

Error codes

Code	When
E_COMPROMISED_DEVICE	Device shows signs of jailbreak or root. Capture is blocked.
E_NO_TRUSTED_HARDWARE	No Secure Enclave, StrongBox, or TEE available and requireTrustedHardware is true.
E_ATTESTATION_FAILED	Hardware key provisioning failed.
E_CAPTURE_FAILED	Camera capture or file I/O failed.
E_SIGNING_FAILED	Hardware signing operation rejected.
E_C2PA_EMBED_FAILED	C2PA manifest could not be built or embedded.

Limitations

• Self-signed certificates — The signing key has a self-signed X.509 certificate with no CA chain. Verifiers will report an unknown signer. Tamper detection works, but attribution requires a CA integration (not yet implemented).
• Camera injection — On a compromised device, an attacker could feed synthetic frames to the camera API. The SDK signs whatever the camera returns.
• Heuristic root detection — Jailbreak/root detection uses basic signals. Sophisticated root hides are not detected. Consider layering with Play Integrity (Android) or App Attest (iOS) for higher assurance.

Platform requirements

Platform	Minimum	Recommended
iOS	14.0	16.0+
Android	API 28 / Android 9	API 30+ / Android 11+ for higher StrongBox availability
Rust	1.75.0	stable
Node	18	22

License

MIT