-
Notifications
You must be signed in to change notification settings - Fork 10
Description
After updating c2patool from 0.18.4 to 0.20.3 our new signed images get error on https://contentcredentials.org/verify: This file may have been tampered with. Its Content Credentials can’t be verified or viewed.
The manifest is slightly different after invoking command:
bin/c2pa/c2patool flower.jpg -o flower_signed.jpg --config '{"alg":"ES256","vendor":"smartframe","private_key":"\/application\/bin\/c2pa\/test\/c2pa-private.key","sign_cert":"\/application\/bin\/c2pa\/test\/c2pa-certificate.pem","ta_url":"http:\/\/timestamp.digicert.com","claim_version":2,"claim_generator":"SmartFrame_Image_Cloud\/1.0.0"}' -f
Old manifest:
{ "active_manifest": "urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe", "manifests": { "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644": { "claim_generator": "Adobe_Firefly adobe_c2pa/0.12.4+sven2 c2pa-rs/0.32.7", "title": "Generated image", "format": "image/jpeg", "instance_id": "xmp:iid:5864d041-7711-4815-8ef8-e2f76c5a1bbc", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "ingredients": [], "assertions": [ { "label": "c2pa.actions", "data": { "actions": [ { "action": "c2pa.created", "softwareAgent": "Adobe Firefly", "parameters": { "com.adobe.firefly.operation": "text_to_image", "com.adobe.firefly.version": "4.0.0-release-firefly_v4-main_69002.71240" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia" } ] } } ], "signature_info": { "alg": "Ps256", "issuer": "Adobe Inc.", "cert_serial_number": "29273495282838142212252668466108829162", "time": "2025-08-27T11:22:10+00:00" }, "label": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644" }, "urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe": { "claim_generator_info": [ { "name": "c2pa-rs", "version": "0.55.0", "org.cai.c2pa_rs": "0.55.0" } ], "title": "flower_signed.jpg", "instance_id": "xmp:iid:2eac0ba8-55e5-4c6b-a8e8-df0f8386d2aa", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "ingredients": [ { "title": "flower.jpg", "format": "image/jpeg", "instance_id": "xmp:iid:a51be00a-e4bb-4577-8fa3-45160eaec29c", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "relationship": "parentOf", "active_manifest": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "validation_results": { "activeManifest": { "success": [ { "code": "signingCredential.ocsp.notRevoked", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "explanation": "claim signature valid" }, { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.actions", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [], "failure": [] } }, "label": "c2pa.ingredient.v3" } ], "assertions": [], "signature_info": { "alg": "Es256", "issuer": "SmartFrame Technologies Ltd", "cert_serial_number": "488761971274233465403683788408333525933889433675", "time": "2025-08-27T12:35:58+00:00" }, "label": "urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe" } }, "validation_results": { "activeManifest": { "success": [ { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.thumbnail.claim.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.ingredient.v3", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ingredient.v3" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [], "failure": [] } }, "validation_state": "Valid" }
New manifest:
{ "active_manifest": "urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe", "manifests": { "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644": { "claim_generator": "Adobe_Firefly adobe_c2pa/0.12.4+sven2 c2pa-rs/0.32.7", "title": "Generated image", "format": "image/jpeg", "instance_id": "xmp:iid:5864d041-7711-4815-8ef8-e2f76c5a1bbc", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "ingredients": [], "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "softwareAgent": "Adobe Firefly", "parameters": { "com.adobe.firefly.operation": "text_to_image", "com.adobe.firefly.version": "4.0.0-release-firefly_v4-main_69002.71240" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia" } ] } } ], "signature_info": { "alg": "Ps256", "issuer": "Adobe Inc.", "common_name": "Adobe Firefly C2PA", "cert_serial_number": "29273495282838142212252668466108829162", "time": "2025-08-27T11:22:10+00:00" }, "label": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644" }, "urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe": { "claim_generator_info": [ { "name": "c2pa-rs", "version": "0.60.1", "org.contentauth.c2pa_rs": "0.60.1" } ], "title": "flower_signed.jpg", "instance_id": "xmp:iid:1f6de5ff-44c8-4121-af29-4a6dd35d50e7", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.thumbnail.claim" }, "ingredients": [ { "title": "flower.jpg", "format": "image/jpeg", "instance_id": "xmp:iid:c8c69b49-cc1c-4c30-944b-80a71bcd7080", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "relationship": "parentOf", "active_manifest": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "validation_results": { "activeManifest": { "success": [ { "code": "signingCredential.ocsp.notRevoked", "url": "OCSP_RESPONSE", "explanation": "certificate not revoked" }, { "code": "timeStamp.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "timestamp message digest matched: Adobe SHA256 ECC256 Timestamp Responder 2025 1" }, { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.actions", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [ { "code": "timeStamp.untrusted", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "timestamp cert untrusted: Adobe SHA256 ECC256 Timestamp Responder 2025 1" } ], "failure": [] } }, "label": "c2pa.ingredient.v3" } ], "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.opened", "parameters": { "ingredients": [ { "url": "self#jumbf=c2pa.assertions/c2pa.ingredient.v3", "hash": "nK3xt4X3mDCg2Rca+jlbgMSB/zT2NpLqHKk86JxPrx0=" } ] } } ], "allActionsIncluded": true } } ], "signature_info": { "alg": "Es256", "issuer": "SmartFrame Technologies Ltd", "common_name": "SmartFrame Technologies Ltd", "cert_serial_number": "488761971274233465403683788408333525933889433675", "time": "2025-08-27T12:37:05+00:00" }, "label": "urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe" } }, "validation_results": { "activeManifest": { "success": [ { "code": "timeStamp.validated", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "timestamp message digest matched: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1" }, { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.thumbnail.claim", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.ingredient.v3", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ingredient.v3" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.actions.v2", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions.v2" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [ { "code": "timeStamp.untrusted", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "timestamp cert untrusted: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1" } ], "failure": [] }, "ingredientDeltas": [ { "ingredientAssertionURI": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.ingredient.v3", "validationDeltas": { "success": [ { "code": "ingredient.manifest.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "explanation": "ingredient hash matched" } ], "informational": [], "failure": [] } } ] }, "validation_state": "Valid" }
Please verify if it's problem with verify site or we should change the way we sign images