ruby-c2pa 0.2.1 → 0.3.0

data/ext/c2pa_native/Cargo.toml

@@ -9,7 +9,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 magnus = { version = "0.8", features = [] }
-c2pa = { version = "0.78", features = ["file_io"] }
+c2pa = { version = "0.90", features = ["file_io"] }
 serde_json = "1"
 
 [profile.release]

data/ext/c2pa_native/src/lib.rs

@@ -1,5 +1,5 @@
 use std::path::Path;
-use c2pa::{create_signer, Builder, Reader, SigningAlg};
+use c2pa::{create_signer, Builder, BuilderIntent, Reader, SigningAlg};
 use magnus::{function, prelude::*, Error, Ruby};
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
@@ -22,6 +22,22 @@ fn alg_from_str(alg: &str) -> Result<SigningAlg, String> {
 
 // ─── Core logic ──────────────────────────────────────────────────────────────
 
+// A c2pa.opened action has to reference its parent ingredient by hashed URI,
+// and that hash is computed over the ingredient assertion as c2pa-rs
+// serialises it. Ruby cannot construct one. Declaring the intent instead lets
+// the SDK derive the parent ingredient from the source and wire the action to
+// it, which is the only way the edit workflow can be expressed.
+fn intent_from_str(intent: &str) -> Result<BuilderIntent, String> {
+    match intent.to_lowercase().as_str() {
+        "edit" => Ok(BuilderIntent::Edit),
+        "update" => Ok(BuilderIntent::Update),
+        _ => Err(format!(
+            "Unknown intent: '{}'. Valid options: edit, update",
+            intent
+        )),
+    }
+}
+
 fn do_sign_file(
     source_path: &str,
     dest_path: &str,
@@ -29,6 +45,7 @@ fn do_sign_file(
     key_path: &str,
     alg_str: &str,
     manifest_json: Option<&str>,
+    intent_str: Option<&str>,
 ) -> Result<(), Box<dyn std::error::Error>> {
     let cert = std::fs::read(cert_path)
         .map_err(|e| format!("Cannot read certificate '{}': {}", cert_path, e))?;
@@ -50,6 +67,10 @@ fn do_sign_file(
     let mut builder = Builder::from_json(json)
         .map_err(|e| format!("Invalid manifest JSON: {}", e))?;
 
+    if let Some(intent) = intent_str {
+        builder.set_intent(intent_from_str(intent)?);
+    }
+
     builder.sign_file(&*signer, source_path, dest_path)
         .map_err(|e| format!("Signing failed: {}", e))?;
 
@@ -71,10 +92,11 @@ fn sign_file(
     key: String,
     alg: Option<String>,
     manifest_json: Option<String>,
+    intent: Option<String>,
 ) -> Result<String, Error> {
     let alg_str = alg.as_deref().unwrap_or("es256");
 
-    do_sign_file(&source, &dest, &cert, &key, alg_str, manifest_json.as_deref())
+    do_sign_file(&source, &dest, &cert, &key, alg_str, manifest_json.as_deref(), intent.as_deref())
         .map_err(|e| Error::new(Ruby::get().expect("called from Ruby thread").exception_runtime_error(), e.to_string()))?;
 
     Ok(dest)
@@ -96,7 +118,7 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     let c2pa = ruby.define_module("C2PA")?;
     let native = c2pa.define_module("Native")?;
 
-    native.define_singleton_method("sign_file", function!(sign_file, 6))?;
+    native.define_singleton_method("sign_file", function!(sign_file, 7))?;
     native.define_singleton_method("read_file", function!(read_file, 1))?;
     native.define_singleton_method("sdk_version", function!(sdk_version, 0))?;
 

data/lib/c2pa/digital_source_types.rb

@@ -0,0 +1,72 @@
+module C2PA
+  # URIs from the IPTC Digital Source Type NewsCodes vocabulary.
+  #
+  # The C2PA specification requires every c2pa.created action to declare one of
+  # these, so consumers can tell how the asset came into being. Pick the one that
+  # honestly describes the asset — this is a provenance claim, and c2pa-rs will
+  # not second-guess the value you supply.
+  #
+  # @see https://cv.iptc.org/newscodes/digitalsourcetype/
+  module DigitalSourceTypes
+    BASE = "http://cv.iptc.org/newscodes/digitalsourcetype"
+
+    # Declining to claim a source type, rather than guessing at one.
+    #
+    # c2pa-rs requires c2pa.created to carry a digitalSourceType but accepts
+    # any string, so a wrong value validates silently. When the origin is not
+    # known — a generic signing service, say — this says so, instead of
+    # asserting something untrue. It is the value c2pa-rs uses throughout its
+    # own fixtures.
+    UNSPECIFIED = "http://c2pa.org/digitalsourcetype/empty"
+
+    # Captured from real life
+    DIGITAL_CAPTURE       = "#{BASE}/digitalCapture"
+    COMPUTATIONAL_CAPTURE = "#{BASE}/computationalCapture"
+    SCREEN_CAPTURE        = "#{BASE}/screenCapture"
+    VIRTUAL_RECORDING     = "#{BASE}/virtualRecording"
+
+    # Digitised from a physical medium
+    NEGATIVE_FILM = "#{BASE}/negativeFilm"
+    POSITIVE_FILM = "#{BASE}/positiveFilm"
+    PRINT         = "#{BASE}/print"
+
+    # Human- or software-authored
+    HUMAN_EDITS              = "#{BASE}/humanEdits"
+    DIGITAL_CREATION         = "#{BASE}/digitalCreation"
+    ALGORITHMICALLY_ENHANCED = "#{BASE}/algorithmicallyEnhanced"
+    DATA_DRIVEN_MEDIA        = "#{BASE}/dataDrivenMedia"
+    ALGORITHMIC_MEDIA        = "#{BASE}/algorithmicMedia"
+
+    # Generative AI
+    TRAINED_ALGORITHMIC_MEDIA                = "#{BASE}/trainedAlgorithmicMedia"
+    COMPOSITE_WITH_TRAINED_ALGORITHMIC_MEDIA = "#{BASE}/compositeWithTrainedAlgorithmicMedia"
+    COMPOSITE_SYNTHETIC                      = "#{BASE}/compositeSynthetic"
+
+    # Composites
+    COMPOSITE         = "#{BASE}/composite"
+    COMPOSITE_CAPTURE = "#{BASE}/compositeCapture"
+
+    # Every type defined above. Supplying a URI outside this list is allowed —
+    # the vocabulary is extensible — but the values here cover the standard set.
+    ALL = [
+      UNSPECIFIED,
+      DIGITAL_CAPTURE,
+      COMPUTATIONAL_CAPTURE,
+      SCREEN_CAPTURE,
+      VIRTUAL_RECORDING,
+      NEGATIVE_FILM,
+      POSITIVE_FILM,
+      PRINT,
+      HUMAN_EDITS,
+      DIGITAL_CREATION,
+      ALGORITHMICALLY_ENHANCED,
+      DATA_DRIVEN_MEDIA,
+      ALGORITHMIC_MEDIA,
+      TRAINED_ALGORITHMIC_MEDIA,
+      COMPOSITE_WITH_TRAINED_ALGORITHMIC_MEDIA,
+      COMPOSITE_SYNTHETIC,
+      COMPOSITE,
+      COMPOSITE_CAPTURE
+    ].freeze
+  end
+end

data/lib/c2pa/manifest.rb

@@ -2,9 +2,44 @@ require "json"
 
 module C2PA
   class Manifest
-    # @param title [String] human-readable title for this asset
-    def initialize(title:)
+    # Intents this gem can express.
+    #
+    # :edit — this asset derives from a parent. c2pa-rs generates the parent
+    #         ingredient from the source file and adds a c2pa.opened action
+    #         wired to it by hashed URI.
+    #
+    # Omitting the intent produces a manifest for a newly created asset.
+    #
+    # c2pa-rs also has an :update intent, a restricted edit for non-editorial
+    # changes. It is not offered here because it requires an ingredient with
+    # real content, and add_ingredient records metadata only — signing with it
+    # fails with "ingredient file not found". Tracked separately.
+    INTENTS = %i[edit].freeze
+
+    # c2pa-rs records itself in a namespaced field alongside the generator
+    # name, so the gem does the same when an application supplies its own.
+    GEM_FIELD = "org.rubygems.ruby_c2pa".freeze
+
+    # @return [Symbol, nil] the builder intent, if any
+    attr_reader :intent
+
+    # @param title  [String] human-readable title for this asset
+    # @param intent [Symbol, nil] :edit; omit for a new creation
+    # @param generator_name    [String, nil] the application doing the signing.
+    #   Defaults to this gem. Supplying it credits your application as the
+    #   claim generator, with the gem recorded alongside.
+    # @param generator_version [String, nil] version of that application
+    # @raise [C2PA::InvalidManifestError] if the intent is not recognised
+    def initialize(title:, intent: nil, generator_name: nil, generator_version: nil)
+      unless intent.nil? || INTENTS.include?(intent)
+        raise InvalidManifestError,
+              "unknown intent #{intent.inspect}. Valid options: #{INTENTS.map(&:inspect).join(', ')}"
+      end
+
       @title = title
+      @intent = intent
+      @generator_name = generator_name
+      @generator_version = generator_version
       @actions = []
       @assertions = []
       @ingredients = []
@@ -26,6 +61,38 @@ module C2PA
                    digital_source_type: nil,
                    changed: nil,
                    parameters: nil)
+      if action == Actions::OPENED
+        raise InvalidManifestError,
+              "#{Actions::OPENED} cannot be added directly. The specification requires it to " \
+              "reference a parentOf ingredient by hashed URI, and that hash is computed over " \
+              "the ingredient as c2pa-rs serialises it, so Ruby cannot construct one. Pass " \
+              "intent: :edit to C2PA::Manifest.new instead and the action will be added for you."
+      end
+
+      # Required as of c2pa-rs 0.90. Earlier versions accepted its absence, so
+      # manifests signed by releases before 0.3.0 are rejected by current
+      # verifiers. No default is supplied: c2pa-rs accepts any string here, so
+      # a guess would validate while asserting something untrue about where the
+      # asset came from. Use DigitalSourceTypes::UNSPECIFIED to decline.
+      if action == Actions::CREATED && to_s_or_nil(digital_source_type).nil?
+        raise InvalidManifestError,
+              "#{Actions::CREATED} requires a digital_source_type. Choose the value that " \
+              "describes how the asset was produced — for example " \
+              "C2PA::DigitalSourceTypes::DIGITAL_CAPTURE for a camera original, or " \
+              "TRAINED_ALGORITHMIC_MEDIA for generative AI. If the origin is genuinely " \
+              "unknown, use C2PA::DigitalSourceTypes::UNSPECIFIED rather than guessing."
+      end
+
+      # Also new in c2pa-rs 0.90.
+      if action == Actions::TRANSLATED
+        missing = %w[sourceLanguage targetLanguage].reject { |key| param_present?(parameters, key) }
+        unless missing.empty?
+          raise InvalidManifestError,
+                "#{Actions::TRANSLATED} requires #{missing.join(' and ')} in parameters, " \
+                "as RFC 5646 language codes"
+        end
+      end
+
       entry = { "action" => action }
       entry["when"]              = when_time                              if when_time
       entry["softwareAgent"]     = software_agent || "ruby-c2pa/#{VERSION}"
@@ -66,12 +133,14 @@ module C2PA
     # Serialize to the JSON structure expected by c2pa-rs.
     #
     # @return [String]
-    # @raise [C2PA::InvalidManifestError] if no actions have been added
+    # @raise [C2PA::InvalidManifestError] if no actions have been added, or if
+    #   any value cannot be represented as JSON
     def to_json
       raise InvalidManifestError, "at least one action is required" if @actions.empty?
 
       manifest = {
         "title" => @title,
+        "claim_generator_info" => [claim_generator_info],
         "assertions" => [
           { "label" => "c2pa.actions.v2", "data" => { "actions" => @actions } },
           *@assertions
@@ -79,7 +148,49 @@ module C2PA
       }
       manifest["ingredients"] = @ingredients unless @ingredients.empty?
 
-      JSON.generate(manifest)
+      begin
+        JSON.generate(manifest)
+      rescue JSON::GeneratorError => e
+        # Typically a string that is not valid UTF-8 — a filename or caption
+        # read in another encoding and passed through untouched. Without this
+        # the caller gets a JSON::GeneratorError, which is not a C2PA::Error
+        # and so escapes `rescue C2PA::Error`.
+        raise InvalidManifestError,
+              "manifest contains text that cannot be encoded as JSON: #{e.message}"
+      end
+    end
+
+    private
+
+    # Parameters may be keyed with strings or symbols depending on the caller.
+    def param_present?(parameters, key)
+      return false unless parameters.is_a?(Hash)
+
+      !to_s_or_nil(parameters[key] || parameters[key.to_sym]).nil?
+    end
+
+    def to_s_or_nil(value)
+      return nil if value.nil?
+
+      string = value.to_s
+      string.empty? ? nil : string
+    end
+
+    # Who signed this. Without it c2pa-rs names itself, so every asset this gem
+    # produced credited "c2pa-rs" and nothing identified the gem or the
+    # application using it.
+    #
+    # c2pa-rs 0.78 permits exactly one entry — supplying two fails with "only 1
+    # claim_generator_info allowed" — so an application name replaces the gem
+    # rather than preceding it, and the gem moves into a namespaced field. That
+    # mirrors how c2pa-rs records itself as org.contentauth.c2pa_rs.
+    def claim_generator_info
+      return { "name" => "ruby-c2pa", "version" => VERSION } if @generator_name.nil?
+
+      info = { "name" => @generator_name }
+      info["version"] = @generator_version if @generator_version
+      info[GEM_FIELD] = VERSION
+      info
     end
   end
 end

data/lib/c2pa/version.rb

@@ -1,3 +1,3 @@
 module C2PA
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

data/lib/c2pa.rb

@@ -2,10 +2,18 @@ require "json"
 require_relative "c2pa/version"
 require_relative "c2pa/error"
 require_relative "c2pa/actions"
+require_relative "c2pa/digital_source_types"
 require_relative "c2pa/manifest"
 require "c2pa/c2pa_native"
 
 module C2PA
+  # Validation states that mean a signed asset is good.
+  #
+  # "Trusted" is "Valid" plus a signing certificate that chains to a root in
+  # the active trust list. Accepting only "Valid" would reject exactly the
+  # production files that are most correct.
+  VALID_STATES = %w[Valid Trusted].freeze
+
   # Sign a file with a C2PA manifest.
   #
   # @param file        [String]          path to the input file
@@ -14,7 +22,10 @@ module C2PA
   # @param key         [String]          path to a PEM-encoded private key
   # @param algorithm   [String]          signing algorithm (default: "es256")
   # @param manifest    [C2PA::Manifest]  the manifest to embed
+  # @param verify      [Boolean]         read the signed file back and confirm it
+  #                                      validates (default: true)
   # @return            [String]          the output path
+  # @raise [C2PA::SigningError] if signing fails, or if the signed file does not validate
   #
   # @example
   #   manifest = C2PA::Manifest.new(title: "Sunset over the bay")
@@ -27,7 +38,7 @@ module C2PA
   #     key:         "key.pem",
   #     manifest:    manifest
   #   )
-  def self.sign(file:, output:, certificate:, key:, algorithm: "es256", manifest:)
+  def self.sign(file:, output:, certificate:, key:, algorithm: "es256", manifest:, verify: true)
     manifest_json = manifest.to_json
 
     raise SigningError, "Source file not found: '#{file}'"             unless File.exist?(file)
@@ -35,9 +46,18 @@ module C2PA
     raise SigningError, "Key file not found: '#{key}'"                 unless File.exist?(key)
     raise SigningError, "Output file already exists: '#{output}'"      if File.exist?(output)
 
-    Native.sign_file(file, output, certificate, key, algorithm, manifest_json)
-  rescue RuntimeError => e
-    raise SigningError, e.message
+    begin
+      # to_json is the only thing genuinely required of a manifest, so an
+      # object that provides just that still signs — as a creation.
+      intent = manifest.respond_to?(:intent) ? manifest.intent&.to_s : nil
+      Native.sign_file(file, output, certificate, key, algorithm, manifest_json, intent)
+    rescue RuntimeError => e
+      raise SigningError, e.message
+    end
+
+    verify_signed_output!(output) if verify
+
+    output
   end
 
   # Read the C2PA manifest embedded in a signed file.
@@ -62,4 +82,48 @@ module C2PA
   def self.sdk_version
     Native.sdk_version
   end
+
+  # Read a freshly signed file back and confirm it actually validates.
+  #
+  # Signing reports success for manifests that verifiers reject. c2pa-rs
+  # applies its rules when reading, not when writing, so without this the gem
+  # hands back a path to a file that fails everywhere else — which is what
+  # released versions did, for years, silently.
+  #
+  # The rejected file is deleted rather than left behind, so a failed sign
+  # cannot leave something shippable on disk.
+  #
+  # @param output [String] path to the signed file
+  # @raise [C2PA::SigningError] if the file does not validate
+  def self.verify_signed_output!(output)
+    result =
+      begin
+        read(file: output)
+      rescue ReadError => e
+        discard(output)
+        raise SigningError, "signed file failed verification: could not read it back: #{e.message}"
+      end
+
+    state = result["validation_state"]
+    return if VALID_STATES.include?(state)
+
+    failures = Array(result.dig("validation_results", "activeManifest", "failure"))
+               .map { |failure| "#{failure["code"]} (#{failure["explanation"]})" }
+    detail = failures.empty? ? "no failure detail reported" : failures.uniq.join(", ")
+
+    discard(output)
+    raise SigningError,
+          "signed file failed verification: validation_state=#{state.inspect}, #{detail}. " \
+          "The output file has been removed. Pass verify: false to keep it for inspection."
+  end
+  private_class_method :verify_signed_output!
+
+  # Remove a file this library created and is about to reject.
+  def self.discard(path)
+    File.delete(path) if File.exist?(path)
+  rescue SystemCallError
+    # Leaving the file behind is better than masking the original failure.
+    nil
+  end
+  private_class_method :discard
 end

data/ruby-c2pa.gemspec

@@ -8,10 +8,35 @@ Gem::Specification.new do |spec|
   spec.summary          = "Ruby bindings for the c2pa content authenticity library"
   spec.description      = "Embed and verify C2PA content provenance and authenticity credentials in images, video, and audio files. Ruby bindings for the official Rust c2pa-rs library."
   spec.license          = "MIT"
-  spec.homepage         = "https://github.com/carlosrodriguez/ruby-c2pa"
-  spec.metadata["source_code_uri"] = spec.homepage
+  spec.homepage         = "https://github.com/eddorre/ruby-c2pa"
 
-  spec.files         = Dir["lib/**/*.rb", "ext/**/*.{rs,toml,rb}", "Rakefile", "*.gemspec", "LICENSE", "README.md"]
+  spec.metadata["source_code_uri"]   = spec.homepage
+  spec.metadata["bug_tracker_uri"]   = "#{spec.homepage}/issues"
+  spec.metadata["changelog_uri"]     = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata["documentation_uri"] = "#{spec.homepage}/blob/main/README.md"
+
+  # Listed explicitly rather than globbed. "ext/**/*.rs" swept in whatever
+  # happened to be under ext/c2pa_native/target, so the package contents
+  # depended on what had been compiled on the machine that ran `gem build` —
+  # 1.3 MB of dependency build-script output shipped in 0.2.1.
+  #
+  # Cargo.lock is included deliberately. The extension is compiled at install
+  # time, so without it every installer resolves the dependency tree afresh.
+  # That is how 0.2.1 shipped against a broken atree and aborted the Ruby
+  # process on TIFF input.
+  spec.files = [
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md",
+    "CONTRIBUTING.md",
+    "Rakefile",
+    "ruby-c2pa.gemspec",
+    "ext/c2pa_native/Cargo.toml",
+    "ext/c2pa_native/Cargo.lock",
+    "ext/c2pa_native/extconf.rb",
+    *Dir["ext/c2pa_native/src/**/*.rs"],
+    *Dir["lib/**/*.rb"]
+  ].sort
   spec.require_paths = ["lib"]
   spec.extensions    = ["ext/c2pa_native/extconf.rb"]
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-c2pa
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Carlos Rodriguez
@@ -74,32 +74,30 @@ extensions:
 - ext/c2pa_native/extconf.rb
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
+- CONTRIBUTING.md
 - LICENSE
 - README.md
 - Rakefile
+- ext/c2pa_native/Cargo.lock
 - ext/c2pa_native/Cargo.toml
 - ext/c2pa_native/extconf.rb
 - ext/c2pa_native/src/lib.rs
-- ext/c2pa_native/target/release/build/oid-registry-c350c75504c969dc/out/oid_db.rs
-- ext/c2pa_native/target/release/build/pix-f303ab89d734032b/out/gamma_lut.rs
-- ext/c2pa_native/target/release/build/serde-2e9abb4d9d73cae4/out/private.rs
-- ext/c2pa_native/target/release/build/serde-f471616b462b0caf/out/private.rs
-- ext/c2pa_native/target/release/build/serde_core-2b94e9134dc44065/out/private.rs
-- ext/c2pa_native/target/release/build/serde_core-3dc945fa0ab21dd5/out/private.rs
-- ext/c2pa_native/target/release/build/thiserror-a1f4c63469c326b9/out/private.rs
-- ext/c2pa_native/target/release/build/typenum-4eb7d34b9fb695ef/out/tests.rs
-- ext/c2pa_native/target/release/build/typenum-b8de96984639a942/out/tests.rs
 - lib/c2pa.rb
 - lib/c2pa/actions.rb
+- lib/c2pa/digital_source_types.rb
 - lib/c2pa/error.rb
 - lib/c2pa/manifest.rb
 - lib/c2pa/version.rb
 - ruby-c2pa.gemspec
-homepage: https://github.com/carlosrodriguez/ruby-c2pa
+homepage: https://github.com/eddorre/ruby-c2pa
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/carlosrodriguez/ruby-c2pa
+  source_code_uri: https://github.com/eddorre/ruby-c2pa
+  bug_tracker_uri: https://github.com/eddorre/ruby-c2pa/issues
+  changelog_uri: https://github.com/eddorre/ruby-c2pa/blob/main/CHANGELOG.md
+  documentation_uri: https://github.com/eddorre/ruby-c2pa/blob/main/README.md
 rdoc_options: []
 require_paths:
 - lib