ruby-c2pa 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98842ac83d8c5e7dacdd28d148cc0e0a0997d2b8ad20205e2d4275238992b813
-  data.tar.gz: 0dd78073b9b631c901658564b3ce5dc8b80e5e4edaaae6e7a9966df760b0b1c5
+  metadata.gz: 66e048e5359881f08def1d3fd82ed11fb8b9b3dfc0d8232d9dbc145026841d39
+  data.tar.gz: bd9108538b9e6d47bd3684d974d2145963345cbdbe67ec44250a1892dd277957
 SHA512:
-  metadata.gz: 05eb4f8d6c31fb6fc6af2facb25c1c3a335fc505b97b46d00c9a846fbc6b72cd5dd0048805fd985f24a615f6a4dc8dde991a089e7d3423256fff63a3cb5566c3
-  data.tar.gz: ca81e533198e62ffe4ae92ef7302653191cf3b5dfb14ae1088b878a97c44b5281073b68db2f04d9ab04dc11662e59c7300db7957db99836e677b0774c9f4baad
+  metadata.gz: 65b8729aa03c0fb5145f1631fc5c847960be95cfd792553d0352c9c9e7f54451a077b3c7eb599c45ff3b7007698aaa9a91d3f05848c0307f192c5d5de2333c25
+  data.tar.gz: 0f46873209bbc9b081a2ef24c276adb0daf079466366a01a712a504d3f0df1eb64b20949fa2f171c469eba9e0da48f429c569b09cba8d5ee48f6e978d3548f72

data/CHANGELOG.md

@@ -7,6 +7,53 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] — 2026-09-11
+
+Adds capability on top of 0.3.0. Nothing is removed and no existing call
+changes behaviour, so this is a minor release.
+
+### Added
+
+- Provenance chaining through ingredients. `add_ingredient` takes an optional
+  `file:`. When the file carries content credentials, its manifest is embedded
+  in the signed output and the ingredient points at it, so a verifier can follow
+  the chain from your asset back through the original. The description-only
+  form is unchanged.
+- `intent: :update` on `C2PA::Manifest`, for non-editorial changes such as
+  correcting metadata. The source file is the parent.
+- `C2PA.configure`, for trust and verification settings. Add a private CA's
+  root as a trust anchor and its certificates validate as `Trusted`; disable
+  `remote_manifest_fetch` and `ocsp_fetch` for environments without network
+  access. Only values you set are sent, so defaults are c2pa-rs's own.
+- Reading content credentials from PDFs. `C2PA.read` now parses a PDF and
+  returns its manifest if one is present. Signing a PDF remains impossible;
+  c2pa-rs has no PDF writer and upstream closed the request to add one.
+- `C2PA::InvalidSettingsError`, raised by `C2PA.configure` for unusable input.
+
+### Changed
+
+- c2pa-rs 0.90.15 → 0.90.22. The range includes security fixes: `h2` updated
+  for RUSTSEC-2026-0258, `chacha20` moved off a yanked version, hardening of
+  BMFF chunk-index handling and CAWG identity bindings. The lockfile ships in
+  the gem, so installers get these once they upgrade.
+- The native layer uses c2pa-rs's Context API rather than the deprecated
+  `Builder::from_json` and `Reader::from_file`, which read settings from
+  thread-local state. One shared Context is reused across calls. Signing from
+  several threads concurrently is now tested.
+- CI fails if a deprecated c2pa-rs API reappears.
+
+### Documentation
+
+- The certificate section no longer claims certificates must chain to a CA in
+  the C2PA trust list, or that self-signed certificates are rejected as such.
+  A private CA works; its certificates carry `signingCredential.untrusted`
+  until the root is added as an anchor. The certificate profile c2pa-rs
+  enforces is listed, including the Authority Key Identifier that
+  `openssl x509 -req` omits by default.
+- PDF is listed as read-only, with a note on what the test suite can and
+  cannot show: nothing available can produce a C2PA-signed PDF, so reading one
+  is untested here, though the code doing it is c2pa-rs's own.
+
 ## [0.3.0] — 2026-08-25
 
 Runs on c2pa-rs 0.90, and fixes every defect found while building a test suite
@@ -99,7 +146,8 @@ Tagged retroactively. See the v0.2.1 tag for the defects it shipped with.
 
 Tagged retroactively.
 
-[Unreleased]: https://github.com/eddorre/ruby-c2pa/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/eddorre/ruby-c2pa/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/eddorre/ruby-c2pa/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/eddorre/ruby-c2pa/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/eddorre/ruby-c2pa/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/eddorre/ruby-c2pa/releases/tag/v0.2.0

data/README.md

@@ -64,22 +64,44 @@ The native Rust library is compiled automatically during installation. This take
 
 ## Preparing your certificate and key
 
-C2PA signing requires an X.509 certificate chain and private key in PEM format. The certificate must chain to a CA that is trusted by the C2PA ecosystem — **self-signed certificates are rejected by c2pa-rs**.
+C2PA signing requires an X.509 certificate chain and private key in PEM format.
+The certificate file contains the end-entity certificate first, then any
+intermediates, and must **not** include the root.
+
+c2pa-rs enforces a certificate profile. An end-entity certificate is rejected
+unless it carries all of:
+
+- Basic Constraints `CA:FALSE`, critical
+- Key Usage with `digitalSignature` or `nonRepudiation`, critical
+- an Extended Key Usage that is present and not `any`, critical
+- a Subject Key Identifier
+- an **Authority Key Identifier**
+
+The last one is easy to miss — `openssl x509 -req` omits it by default, and the
+certificate is then rejected with nothing more specific than
+`the certificate is invalid`.
+
+### Whose CA?
+
+A certificate from a CA in the C2PA trust list validates as `Trusted` with no
+configuration.
+
+A certificate from your own CA validates as `Valid` and carries
+`signingCredential.untrusted` — which does **not** make the manifest invalid.
+To have it treated as trusted, add your root as a trust anchor; see
+[Configuring trust](#configuring-trust).
 
 ### Development and testing
 
-The c2pa-rs project publishes test certificates that work for local development:
+The test suite generates its own certificates for every supported algorithm:
 
 ```bash
-curl -sL -o test_cert.pem https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/certs/es256.pub
-curl -sL -o test_key.pem  https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/certs/es256.pem
+bundle exec rake fixtures:certs
 ```
 
-Files signed with these test certificates will include a `signingCredential.untrusted` validation warning since the test CA is not in the public trust list, but are otherwise valid for development purposes.
-
-### Production
-
-Obtain a certificate from a CA trusted by the C2PA ecosystem. The certificate file must contain the full chain (end-entity certificate first, then any intermediates), but must **not** include the root CA.
+They land in `test/fixtures/certs/` and are not committed. See
+[`test/fixtures/generate_certs.rb`](test/fixtures/generate_certs.rb) for a
+worked example of building a chain c2pa-rs accepts.
 
 The supported signing algorithms are: `es256`, `es384`, `es512`, `ps256`, `ps384`, `ps512`, `ed25519`.
 
@@ -212,16 +234,42 @@ manifest.add_assertion(
 
 ### Adding ingredients
 
-Ingredients record the source assets a file was derived from:
+Ingredients record the source assets a file was derived from. Supply the file
+so c2pa-rs can read it:
 
 ```ruby
 manifest.add_ingredient(
   title:        "Original photo",
   format:       "image/jpeg",
-  instance_id:  "xmp:iid:original-uuid-here"
+  instance_id:  "xmp:iid:original-uuid-here",
+  relationship: "componentOf",
+  file:         "original.jpg"
 )
 ```
 
+If the ingredient already carries content credentials, its manifest is embedded
+in the signed output and the ingredient points at it. A verifier can then
+follow the chain from your asset back through the original. For a file with no
+credentials there is nothing to carry forward.
+
+Omitting `file:` records the description alone. Nothing binds it to any bytes,
+so a verifier cannot check the claim. That form is kept for compatibility;
+prefer the file.
+
+### Updating an existing asset
+
+For a non-editorial change to an asset, such as correcting metadata, use
+`intent: :update`. The source file is the parent, and the change is recorded
+against it without opening a new editing lineage:
+
+```ruby
+manifest = C2PA::Manifest.new(title: "Metadata corrected", intent: :update)
+  .add_action(C2PA::Actions::EDITED_METADATA)
+```
+
+c2pa-rs restricts this mode: there is exactly one ingredient, it is the source
+itself, and the hashed content must not change.
+
 ### Signing a file
 
 The `output` path must not already exist — `C2PA.sign` will raise a `C2PA::SigningError` if the file is already there.
@@ -352,14 +400,62 @@ rescue C2PA::Error => e
 end
 ```
 
+## Configuring trust
+
+c2pa-rs checks the signing certificate against a trust list, and reports
+`Trusted` when it chains to a root that list contains. That happens by default,
+so a certificate from a CA in the C2PA trust list needs no configuration.
+
+For a private or enterprise CA, add its root:
+
+```ruby
+C2PA.configure do |config|
+  config.trust_anchors = "ca/root.pem"   # a path, or the PEM text itself
+end
+```
+
+Files signed by a certificate chaining to it then validate as `Trusted` rather
+than carrying `signingCredential.untrusted`.
+
+### Offline and air-gapped environments
+
+Reading an asset may fetch a remote manifest over the network, and revocation
+checking may contact an OCSP responder. Both can be turned off:
+
+```ruby
+C2PA.configure do |config|
+  config.remote_manifest_fetch = false
+  config.ocsp_fetch            = false
+end
+```
+
+### Everything configurable
+
+| Setting | Default | Purpose |
+|---------|---------|---------|
+| `trust_anchors` | none | additional roots to trust, as PEM |
+| `trust_list` | C2PA list | replaces the trust list rather than adding to it |
+| `allowed_certificates` | none | explicitly allowed certificates, as PEM |
+| `verify_trust` | `true` | whether trust is checked at all |
+| `remote_manifest_fetch` | `true` | whether reading may fetch over the network |
+| `ocsp_fetch` | `false` | whether revocation is checked over OCSP |
+
+Settings are global and apply to subsequent calls. Only values you set are
+sent, so anything left alone keeps c2pa-rs's own default. `C2PA.configure` with
+no block resets everything.
+
+Turning `verify_trust` off means nothing is ever reported as untrusted, which
+in a library for establishing provenance is rarely what you want. It exists for
+environments that cannot reach a trust list at all.
+
 ## Supported file formats
 
 Each format below has a fixture and a signing test in the suite: the file is
 signed, read back, and asserted to validate.
 
-| Format | MIME type |
-|--------|-----------|
-| JPEG | `image/jpeg` |
+| Format | MIME type | |
+|--------|-----------|--|
+| JPEG | `image/jpeg` | |
 | PNG | `image/png` |
 | WebP | `image/webp` |
 | TIFF | `image/tiff` |
@@ -369,19 +465,31 @@ signed, read back, and asserted to validate.
 | MOV | `video/quicktime` |
 | MP3 | `audio/mpeg` |
 | WAV | `audio/wav` |
+| PDF | `application/pdf` | read only, see below |
 
 The format is detected automatically from the file extension.
 
 JPEG XL must be in the ISOBMFF container form. A bare codestream has no boxes
 to hold a manifest, and c2pa-rs rejects it.
 
-### Not supported
+### PDF is read-only
+
+`C2PA.read` works on a PDF that carries content credentials, such as one signed
+by Adobe Acrobat. `C2PA.sign` does not: c2pa-rs has no PDF writer at any
+version. `get_writer` returns `None` and `save_cai_store` returns
+`NotImplemented`, and upstream closed the request to expose one in December
+2025 (contentauth/c2pa-rs#527). Signing a PDF raises `C2PA::SigningError`
+with `type is unsupported`.
+
+Earlier releases of this gem listed PDF as signable. That was never correct.
 
-**PDF cannot be signed.** c2pa-rs can read C2PA data out of a PDF but has no
-writer for it — `get_writer` returns `None` and `save_cai_store` returns
-`NotImplemented` — so `C2PA.sign` raises `C2PA::SigningError` with
-`type is unsupported`. This is true at every c2pa-rs version. Earlier releases
-of this gem listed PDF as supported; that was never correct.
+One limit on what the test suite can show. It proves the PDF handler is active,
+by reading a PDF with no credentials and getting `no JUMBF data found` rather
+than `type is unsupported`. It cannot prove that a signed PDF returns its
+manifest, because nothing available can produce one: c2pa-rs cannot write
+them, and no local tool can either. The code doing the reading is c2pa-rs's
+own and is tested upstream; what is untested here is only this gem's
+integration with the success path.
 
 ### Test fixtures