Skip to content

Invalid parent image: "This file may have been tampered with. Its Content Credentials can’t be verified or viewed." #316

@michalkorotkiewicz

Description

@michalkorotkiewicz

After updating c2patool from 0.18.4 to 0.20.3 our new signed images get error on https://contentcredentials.org/verify: This file may have been tampered with. Its Content Credentials can’t be verified or viewed.

The manifest is slightly different after invoking command:
bin/c2pa/c2patool flower.jpg -o flower_signed.jpg --config '{"alg":"ES256","vendor":"smartframe","private_key":"\/application\/bin\/c2pa\/test\/c2pa-private.key","sign_cert":"\/application\/bin\/c2pa\/test\/c2pa-certificate.pem","ta_url":"http:\/\/timestamp.digicert.com","claim_version":2,"claim_generator":"SmartFrame_Image_Cloud\/1.0.0"}' -f

Old manifest:

{ "active_manifest": "urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe", "manifests": { "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644": { "claim_generator": "Adobe_Firefly adobe_c2pa/0.12.4+sven2 c2pa-rs/0.32.7", "title": "Generated image", "format": "image/jpeg", "instance_id": "xmp:iid:5864d041-7711-4815-8ef8-e2f76c5a1bbc", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "ingredients": [], "assertions": [ { "label": "c2pa.actions", "data": { "actions": [ { "action": "c2pa.created", "softwareAgent": "Adobe Firefly", "parameters": { "com.adobe.firefly.operation": "text_to_image", "com.adobe.firefly.version": "4.0.0-release-firefly_v4-main_69002.71240" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia" } ] } } ], "signature_info": { "alg": "Ps256", "issuer": "Adobe Inc.", "cert_serial_number": "29273495282838142212252668466108829162", "time": "2025-08-27T11:22:10+00:00" }, "label": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644" }, "urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe": { "claim_generator_info": [ { "name": "c2pa-rs", "version": "0.55.0", "org.cai.c2pa_rs": "0.55.0" } ], "title": "flower_signed.jpg", "instance_id": "xmp:iid:2eac0ba8-55e5-4c6b-a8e8-df0f8386d2aa", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "ingredients": [ { "title": "flower.jpg", "format": "image/jpeg", "instance_id": "xmp:iid:a51be00a-e4bb-4577-8fa3-45160eaec29c", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "relationship": "parentOf", "active_manifest": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "validation_results": { "activeManifest": { "success": [ { "code": "signingCredential.ocsp.notRevoked", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "explanation": "claim signature valid" }, { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.actions", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [], "failure": [] } }, "label": "c2pa.ingredient.v3" } ], "assertions": [], "signature_info": { "alg": "Es256", "issuer": "SmartFrame Technologies Ltd", "cert_serial_number": "488761971274233465403683788408333525933889433675", "time": "2025-08-27T12:35:58+00:00" }, "label": "urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe" } }, "validation_results": { "activeManifest": { "success": [ { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.thumbnail.claim.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.ingredient.v3", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ingredient.v3" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:c2pa:3b041b77-09c6-46b1-a141-0a1a161d6141:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [], "failure": [] } }, "validation_state": "Valid" }

New manifest:

{ "active_manifest": "urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe", "manifests": { "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644": { "claim_generator": "Adobe_Firefly adobe_c2pa/0.12.4+sven2 c2pa-rs/0.32.7", "title": "Generated image", "format": "image/jpeg", "instance_id": "xmp:iid:5864d041-7711-4815-8ef8-e2f76c5a1bbc", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "ingredients": [], "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.created", "softwareAgent": "Adobe Firefly", "parameters": { "com.adobe.firefly.operation": "text_to_image", "com.adobe.firefly.version": "4.0.0-release-firefly_v4-main_69002.71240" }, "digitalSourceType": "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia" } ] } } ], "signature_info": { "alg": "Ps256", "issuer": "Adobe Inc.", "common_name": "Adobe Firefly C2PA", "cert_serial_number": "29273495282838142212252668466108829162", "time": "2025-08-27T11:22:10+00:00" }, "label": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644" }, "urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe": { "claim_generator_info": [ { "name": "c2pa-rs", "version": "0.60.1", "org.contentauth.c2pa_rs": "0.60.1" } ], "title": "flower_signed.jpg", "instance_id": "xmp:iid:1f6de5ff-44c8-4121-af29-4a6dd35d50e7", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.thumbnail.claim" }, "ingredients": [ { "title": "flower.jpg", "format": "image/jpeg", "instance_id": "xmp:iid:c8c69b49-cc1c-4c30-944b-80a71bcd7080", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "relationship": "parentOf", "active_manifest": "urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "validation_results": { "activeManifest": { "success": [ { "code": "signingCredential.ocsp.notRevoked", "url": "OCSP_RESPONSE", "explanation": "certificate not revoked" }, { "code": "timeStamp.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "timestamp message digest matched: Adobe SHA256 ECC256 Timestamp Responder 2025 1" }, { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.thumbnail.claim.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.actions", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [ { "code": "timeStamp.untrusted", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644/c2pa.signature", "explanation": "timestamp cert untrusted: Adobe SHA256 ECC256 Timestamp Responder 2025 1" } ], "failure": [] } }, "label": "c2pa.ingredient.v3" } ], "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.opened", "parameters": { "ingredients": [ { "url": "self#jumbf=c2pa.assertions/c2pa.ingredient.v3", "hash": "nK3xt4X3mDCg2Rca+jlbgMSB/zT2NpLqHKk86JxPrx0=" } ] } } ], "allActionsIncluded": true } } ], "signature_info": { "alg": "Es256", "issuer": "SmartFrame Technologies Ltd", "common_name": "SmartFrame Technologies Ltd", "cert_serial_number": "488761971274233465403683788408333525933889433675", "time": "2025-08-27T12:37:05+00:00" }, "label": "urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe" } }, "validation_results": { "activeManifest": { "success": [ { "code": "timeStamp.validated", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "timestamp message digest matched: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1" }, { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.thumbnail.claim", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.ingredient.v3", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ingredient.v3" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.actions.v2", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions.v2" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [ { "code": "timeStamp.untrusted", "url": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.signature", "explanation": "timestamp cert untrusted: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1" } ], "failure": [] }, "ingredientDeltas": [ { "ingredientAssertionURI": "self#jumbf=/c2pa/urn:c2pa:6d72a10b-6266-405a-9819-e659ed796b0a:smartframe/c2pa.assertions/c2pa.ingredient.v3", "validationDeltas": { "success": [ { "code": "ingredient.manifest.validated", "url": "self#jumbf=/c2pa/urn:uuid:5747eec8-53bf-4d0e-811d-9b8172f31644", "explanation": "ingredient hash matched" } ], "informational": [], "failure": [] } } ] }, "validation_state": "Valid" }

Please verify if it's problem with verify site or we should change the way we sign images

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions