ruby-c2pa 0.3.0 → 0.4.0

data/ext/c2pa_native/Cargo.toml

@@ -9,7 +9,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 magnus = { version = "0.8", features = [] }
-c2pa = { version = "0.90", features = ["file_io"] }
+c2pa = { version = "0.90", features = ["file_io", "pdf"] }
 serde_json = "1"
 
 [profile.release]

data/ext/c2pa_native/src/lib.rs

@@ -1,9 +1,52 @@
+use std::fs::File;
 use std::path::Path;
-use c2pa::{create_signer, Builder, BuilderIntent, Reader, SigningAlg};
+use std::sync::{Arc, RwLock, OnceLock};
+use c2pa::{create_signer, Builder, BuilderIntent, Context, Reader, SigningAlg};
 use magnus::{function, prelude::*, Error, Ruby};
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
+// A Context carries the settings c2pa-rs validates against — trust anchors,
+// what to verify, whether to fetch remote manifests. The older entry points
+// read those from thread-local state, which is why they are deprecated: a
+// threaded Ruby application could see different settings depending on which
+// thread it signed from.
+//
+// One shared Context is built lazily and reused. It is Send + Sync, so an Arc
+// is all that sharing requires, and reusing it avoids re-reading configuration
+// on every call.
+//
+// It currently carries defaults. Exposing settings to Ruby is a separate piece
+// of work; this is the seam that makes it possible.
+fn context_slot() -> &'static RwLock<Arc<Context>> {
+    static CONTEXT: OnceLock<RwLock<Arc<Context>>> = OnceLock::new();
+    CONTEXT.get_or_init(|| RwLock::new(Context::new().into_shared()))
+}
+
+fn shared_context() -> Arc<Context> {
+    context_slot()
+        .read()
+        .expect("context lock poisoned")
+        .clone()
+}
+
+// Replace the shared Context with one built from the supplied settings.
+//
+// c2pa-rs takes settings as JSON, so the Ruby side assembles the document and
+// this only has to validate and install it. Rebuilding rather than mutating
+// keeps the Context immutable once shared: signing already in flight on another
+// thread continues against the settings it started with.
+fn do_configure(settings_json: &str) -> Result<(), Box<dyn std::error::Error>> {
+    let context = Context::new()
+        .with_settings(settings_json)
+        .map_err(|e| format!("Invalid settings: {}", e))?
+        .into_shared();
+
+    *context_slot().write().map_err(|_| "context lock poisoned")? = context;
+
+    Ok(())
+}
+
 fn alg_from_str(alg: &str) -> Result<SigningAlg, String> {
     match alg.to_lowercase().as_str() {
         "ps256" => Ok(SigningAlg::Ps256),
@@ -38,6 +81,41 @@ fn intent_from_str(intent: &str) -> Result<BuilderIntent, String> {
     }
 }
 
+// Ingredients supplied as files rather than as descriptions. c2pa-rs reads the
+// bytes to hash them, generate a thumbnail, and carry forward any manifest the
+// file already holds; the JSON description takes precedence over anything
+// derived from the stream.
+//
+// Expects a JSON array of {"json": "<ingredient JSON>", "format": "<mime>",
+// "path": "<file>"}.
+fn add_ingredient_files(
+    builder: &mut Builder,
+    ingredient_files_json: &str,
+) -> Result<(), Box<dyn std::error::Error>> {
+    let entries: serde_json::Value = serde_json::from_str(ingredient_files_json)
+        .map_err(|e| format!("Invalid ingredient list: {}", e))?;
+    let entries = entries
+        .as_array()
+        .ok_or("Invalid ingredient list: expected an array")?;
+
+    for entry in entries {
+        let field = |name: &str| -> Result<&str, String> {
+            entry[name]
+                .as_str()
+                .ok_or_else(|| format!("Invalid ingredient list: missing '{}'", name))
+        };
+        let (json, format, path) = (field("json")?, field("format")?, field("path")?);
+
+        let mut stream = File::open(path)
+            .map_err(|e| format!("Cannot read ingredient '{}': {}", path, e))?;
+        builder
+            .add_ingredient_from_stream(json, format, &mut stream)
+            .map_err(|e| format!("Cannot add ingredient '{}': {}", path, e))?;
+    }
+
+    Ok(())
+}
+
 fn do_sign_file(
     source_path: &str,
     dest_path: &str,
@@ -46,6 +124,7 @@ fn do_sign_file(
     alg_str: &str,
     manifest_json: Option<&str>,
     intent_str: Option<&str>,
+    ingredient_files_json: Option<&str>,
 ) -> Result<(), Box<dyn std::error::Error>> {
     let cert = std::fs::read(cert_path)
         .map_err(|e| format!("Cannot read certificate '{}': {}", cert_path, e))?;
@@ -64,13 +143,18 @@ fn do_sign_file(
     let default_json = format!(r#"{{"title": "{}"}}"#, title);
     let json = manifest_json.unwrap_or(&default_json);
 
-    let mut builder = Builder::from_json(json)
+    let mut builder = Builder::from_shared_context(&shared_context())
+        .with_definition(json)
         .map_err(|e| format!("Invalid manifest JSON: {}", e))?;
 
     if let Some(intent) = intent_str {
         builder.set_intent(intent_from_str(intent)?);
     }
 
+    if let Some(files) = ingredient_files_json {
+        add_ingredient_files(&mut builder, files)?;
+    }
+
     builder.sign_file(&*signer, source_path, dest_path)
         .map_err(|e| format!("Signing failed: {}", e))?;
 
@@ -78,7 +162,8 @@ fn do_sign_file(
 }
 
 fn do_read_file(path: &str) -> Result<String, Box<dyn std::error::Error>> {
-    let reader = Reader::from_file(path)
+    let reader = Reader::from_shared_context(&shared_context())
+        .with_file(path)
         .map_err(|e| format!("Failed to read manifest from '{}': {}", path, e))?;
     Ok(reader.json())
 }
@@ -93,10 +178,12 @@ fn sign_file(
     alg: Option<String>,
     manifest_json: Option<String>,
     intent: Option<String>,
+    ingredient_files: Option<String>,
 ) -> Result<String, Error> {
     let alg_str = alg.as_deref().unwrap_or("es256");
 
-    do_sign_file(&source, &dest, &cert, &key, alg_str, manifest_json.as_deref(), intent.as_deref())
+    do_sign_file(&source, &dest, &cert, &key, alg_str, manifest_json.as_deref(),
+                 intent.as_deref(), ingredient_files.as_deref())
         .map_err(|e| Error::new(Ruby::get().expect("called from Ruby thread").exception_runtime_error(), e.to_string()))?;
 
     Ok(dest)
@@ -107,6 +194,15 @@ fn read_file(path: String) -> Result<String, Error> {
         .map_err(|e| Error::new(Ruby::get().expect("called from Ruby thread").exception_runtime_error(), e.to_string()))
 }
 
+fn configure(settings_json: String) -> Result<(), Error> {
+    do_configure(&settings_json).map_err(|e| {
+        Error::new(
+            Ruby::get().expect("called from Ruby thread").exception_runtime_error(),
+            e.to_string(),
+        )
+    })
+}
+
 fn sdk_version() -> String {
     c2pa::VERSION.to_string()
 }
@@ -118,8 +214,9 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     let c2pa = ruby.define_module("C2PA")?;
     let native = c2pa.define_module("Native")?;
 
-    native.define_singleton_method("sign_file", function!(sign_file, 7))?;
+    native.define_singleton_method("sign_file", function!(sign_file, 8))?;
     native.define_singleton_method("read_file", function!(read_file, 1))?;
+    native.define_singleton_method("configure", function!(configure, 1))?;
     native.define_singleton_method("sdk_version", function!(sdk_version, 0))?;
 
     Ok(())

data/lib/c2pa/config.rb

@@ -0,0 +1,90 @@
+require "json"
+
+module C2PA
+  # Settings that govern how c2pa-rs validates.
+  #
+  # These reach the SDK through its Context, which is rebuilt whenever they
+  # change. Signing already in flight on another thread continues against the
+  # settings it started with.
+  #
+  # Defaults are c2pa-rs's own, so a gem that never calls C2PA.configure
+  # behaves exactly as it did before this existed.
+  class Config
+    # Additional root certificates to trust, as a PEM bundle. Use this for a
+    # private or enterprise CA: a certificate chaining to one of these
+    # validates as "Trusted" rather than carrying signingCredential.untrusted.
+    attr_accessor :trust_anchors
+
+    # The trust list proper — normally the C2PA-recognised anchors. Setting
+    # this replaces that list rather than adding to it, so prefer
+    # trust_anchors unless you mean to substitute the whole thing.
+    attr_accessor :trust_list
+
+    # Explicitly allowed certificates, as a PEM bundle.
+    attr_accessor :allowed_certificates
+
+    # Whether to check certificates against the trust list at all.
+    #
+    # Turning this off means nothing is ever reported as untrusted, which in a
+    # library for establishing provenance is rarely what you want. It exists
+    # for offline and air-gapped environments.
+    attr_accessor :verify_trust
+
+    # Whether reading an asset may fetch a manifest over the network.
+    # c2pa-rs defaults this to true, so reading can make an outbound request.
+    attr_accessor :remote_manifest_fetch
+
+    # Whether to check certificate revocation over OCSP, which also makes
+    # network requests.
+    attr_accessor :ocsp_fetch
+
+    def initialize
+      @trust_anchors = nil
+      @trust_list = nil
+      @allowed_certificates = nil
+      @verify_trust = nil
+      @remote_manifest_fetch = nil
+      @ocsp_fetch = nil
+    end
+
+    # The settings document c2pa-rs expects.
+    #
+    # Only values that were actually set are included, so anything left alone
+    # keeps the SDK's default rather than being pinned to ours.
+    #
+    # @return [String] JSON
+    def to_json
+      trust = {}
+      trust["user_anchors"] = read_pem(@trust_anchors)        unless @trust_anchors.nil?
+      trust["trust_anchors"] = read_pem(@trust_list)          unless @trust_list.nil?
+      trust["allowed_list"] = read_pem(@allowed_certificates) unless @allowed_certificates.nil?
+
+      verify = {}
+      verify["verify_trust"] = @verify_trust                   unless @verify_trust.nil?
+      verify["remote_manifest_fetch"] = @remote_manifest_fetch unless @remote_manifest_fetch.nil?
+      verify["ocsp_fetch"] = @ocsp_fetch                       unless @ocsp_fetch.nil?
+
+      settings = {}
+      settings["trust"] = trust unless trust.empty?
+      settings["verify"] = verify unless verify.empty?
+
+      JSON.generate(settings)
+    end
+
+    private
+
+    # Accept either PEM text or a path to a file containing it, since callers
+    # naturally have one or the other.
+    def read_pem(value)
+      string = value.to_s
+      return string if string.include?("BEGIN CERTIFICATE")
+
+      unless File.exist?(string)
+        raise InvalidSettingsError,
+              "expected PEM text or a readable file, got #{string.inspect}"
+      end
+
+      File.read(string)
+    end
+  end
+end

data/lib/c2pa/error.rb

@@ -3,4 +3,7 @@ module C2PA
   class SigningError < Error; end
   class ReadError < Error; end
   class InvalidManifestError < Error; end
+
+  # Raised when C2PA.configure is given something it cannot use.
+  class InvalidSettingsError < Error; end
 end

data/lib/c2pa/manifest.rb

@@ -4,17 +4,15 @@ module C2PA
   class Manifest
     # Intents this gem can express.
     #
-    # :edit — this asset derives from a parent. c2pa-rs generates the parent
-    #         ingredient from the source file and adds a c2pa.opened action
-    #         wired to it by hashed URI.
+    # :edit   — this asset derives from a parent. c2pa-rs generates the parent
+    #           ingredient from the source file and adds a c2pa.opened action
+    #           wired to it by hashed URI.
+    # :update — a restricted edit for non-editorial changes, such as fixing
+    #           metadata. The parent is the source file itself; an explicit
+    #           ingredient, if given, must be that same file.
     #
     # Omitting the intent produces a manifest for a newly created asset.
-    #
-    # c2pa-rs also has an :update intent, a restricted edit for non-editorial
-    # changes. It is not offered here because it requires an ingredient with
-    # real content, and add_ingredient records metadata only — signing with it
-    # fails with "ingredient file not found". Tracked separately.
-    INTENTS = %i[edit].freeze
+    INTENTS = %i[edit update].freeze
 
     # c2pa-rs records itself in a namespaced field alongside the generator
     # name, so the gem does the same when an application supplies its own.
@@ -43,8 +41,16 @@ module C2PA
       @actions = []
       @assertions = []
       @ingredients = []
+      @ingredient_files = []
     end
 
+    # Ingredients supplied as files, for the signing layer to hand to c2pa-rs.
+    # Each is a Hash with the ingredient's JSON description, its format, and
+    # the path to read.
+    #
+    # @return [Array<Hash>]
+    attr_reader :ingredient_files
+
     # Add a C2PA action to this manifest.
     #
     # @param action [String] one of the C2PA::Actions constants
@@ -115,18 +121,48 @@ module C2PA
 
     # Add an ingredient (source asset) to this manifest.
     #
-    # @param title       [String] human-readable title of the ingredient
-    # @param format      [String] MIME type of the ingredient, e.g. "image/jpeg"
-    # @param instance_id [String] unique identifier for the ingredient instance
+    # With `file:`, c2pa-rs reads the ingredient itself. If that file carries
+    # content credentials, its manifest is embedded and the ingredient points
+    # at it, so provenance chains from the original through to this asset. A
+    # verifier can then follow and check the whole history.
+    #
+    # For a file with no credentials there is nothing to carry forward, and
+    # the result is the same as the description alone. (Thumbnails would be
+    # the other contribution, but they need c2pa-rs's `add_thumbnails`
+    # feature, which this gem does not enable.)
+    #
+    # Without `file:`, only the description is recorded. Nothing binds it to
+    # any actual bytes. This form is kept for compatibility.
+    #
+    # @param title        [String] human-readable title of the ingredient
+    # @param format       [String] MIME type of the ingredient, e.g. "image/jpeg"
+    # @param instance_id  [String] unique identifier for the ingredient instance
     # @param relationship [String] relationship to this asset; defaults to "parentOf"
+    # @param file         [String, nil] path to the ingredient file
     # @return [self]
-    def add_ingredient(title:, format:, instance_id:, relationship: "parentOf")
-      @ingredients << {
+    # @raise [C2PA::InvalidManifestError] if `file` is given but cannot be read
+    def add_ingredient(title:, format:, instance_id:, relationship: "parentOf", file: nil)
+      description = {
         "title"        => title,
         "format"       => format,
         "instance_id"  => instance_id,
         "relationship" => relationship
       }
+
+      if file.nil?
+        @ingredients << description
+        return self
+      end
+
+      unless File.file?(file) && File.readable?(file)
+        raise InvalidManifestError, "ingredient file not readable: #{file.inspect}"
+      end
+
+      @ingredient_files << {
+        "json"   => JSON.generate(description),
+        "format" => format,
+        "path"   => File.expand_path(file)
+      }
       self
     end
 

data/lib/c2pa/version.rb

@@ -1,3 +1,3 @@
 module C2PA
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/lib/c2pa.rb

@@ -3,6 +3,7 @@ require_relative "c2pa/version"
 require_relative "c2pa/error"
 require_relative "c2pa/actions"
 require_relative "c2pa/digital_source_types"
+require_relative "c2pa/config"
 require_relative "c2pa/manifest"
 require "c2pa/c2pa_native"
 
@@ -14,6 +15,39 @@ module C2PA
   # production files that are most correct.
   VALID_STATES = %w[Valid Trusted].freeze
 
+  # Configure how c2pa-rs validates.
+  #
+  # Settings are global and take effect for subsequent calls. Signing already
+  # in flight on another thread continues against the settings it started
+  # with, since the underlying context is replaced rather than mutated.
+  #
+  # @yieldparam config [C2PA::Config]
+  # @return [C2PA::Config] the configuration that was applied
+  # @raise [C2PA::InvalidSettingsError] if the settings are not usable
+  #
+  # @example Trusting a private CA
+  #   C2PA.configure do |config|
+  #     config.trust_anchors = "ca/root.pem"
+  #   end
+  #
+  # @example An offline environment
+  #   C2PA.configure do |config|
+  #     config.remote_manifest_fetch = false
+  #     config.ocsp_fetch = false
+  #   end
+  def self.configure
+    config = Config.new
+    yield config if block_given?
+
+    begin
+      Native.configure(config.to_json)
+    rescue RuntimeError => e
+      raise InvalidSettingsError, e.message
+    end
+
+    config
+  end
+
   # Sign a file with a C2PA manifest.
   #
   # @param file        [String]          path to the input file
@@ -50,7 +84,10 @@ module C2PA
       # to_json is the only thing genuinely required of a manifest, so an
       # object that provides just that still signs — as a creation.
       intent = manifest.respond_to?(:intent) ? manifest.intent&.to_s : nil
-      Native.sign_file(file, output, certificate, key, algorithm, manifest_json, intent)
+      files = manifest.respond_to?(:ingredient_files) ? manifest.ingredient_files : []
+      ingredient_files = files.empty? ? nil : JSON.generate(files)
+      Native.sign_file(file, output, certificate, key, algorithm, manifest_json,
+                       intent, ingredient_files)
     rescue RuntimeError => e
       raise SigningError, e.message
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-c2pa
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Carlos Rodriguez
@@ -85,6 +85,7 @@ files:
 - ext/c2pa_native/src/lib.rs
 - lib/c2pa.rb
 - lib/c2pa/actions.rb
+- lib/c2pa/config.rb
 - lib/c2pa/digital_source_types.rb
 - lib/c2pa/error.rb
 - lib/c2pa/manifest.rb