ruby-c2pa 0.3.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98842ac83d8c5e7dacdd28d148cc0e0a0997d2b8ad20205e2d4275238992b813
-  data.tar.gz: 0dd78073b9b631c901658564b3ce5dc8b80e5e4edaaae6e7a9966df760b0b1c5
+  metadata.gz: 41362e47552927fd69a0bec7203dc35f59442af7eeaeb1d5f787216e08c18b79
+  data.tar.gz: 6e93a632b24a7baddf4ba4792d8a9f8043559fd5c168df1a685b8094a73f9689
 SHA512:
-  metadata.gz: 05eb4f8d6c31fb6fc6af2facb25c1c3a335fc505b97b46d00c9a846fbc6b72cd5dd0048805fd985f24a615f6a4dc8dde991a089e7d3423256fff63a3cb5566c3
-  data.tar.gz: ca81e533198e62ffe4ae92ef7302653191cf3b5dfb14ae1088b878a97c44b5281073b68db2f04d9ab04dc11662e59c7300db7957db99836e677b0774c9f4baad
+  metadata.gz: b9d9de8da30c033cc5e64ea2d27609ce8be1a9b3d08c400c98f4a092c9ad85f27a985f347477ecd3b019366cf75f9c9c65d17a40f94ce1f82476b753b5dc4a85
+  data.tar.gz: d888086e87c7eec8fd09d5f8fadb4f6e5f9493d3ecc7199264c10c38bfc254aead1e380d881bbc3b9ad3c7569e30220f57764e85bebe1f98bd0f1a8b816c4e54

data/CHANGELOG.md

@@ -7,6 +7,90 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-09-12
+
+Adds capability on top of 0.4.0. Nothing is removed and no existing call
+changes behaviour, so this is a minor release. The one change every caller
+will feel is that native calls no longer hold the GVL, which only makes other
+threads faster.
+
+### Added
+
+- Buffer signing. `C2PA.sign_buffer(data:, format:, ...)` signs bytes held in
+  memory and returns the signed bytes; `C2PA.read_buffer(data:, format: nil)`
+  reads them back. Both require a binary string and raise `ArgumentError` for
+  any other encoding rather than transcoding the asset. The verify-after-sign
+  guard applies to buffers as it does to files. Memory use is about four
+  times the asset.
+- The native calls (`sign_file`, `sign_buffer`, `read_file`, `read_buffer`)
+  release Ruby's global VM lock while c2pa-rs runs. Other Ruby threads keep
+  running during a sign; previously they were blocked until it returned.
+  Measured alongside a busy Ruby thread, the process now uses about 1.9
+  CPU-seconds per wall-second against 1.0 before. `Thread#kill` and
+  `Timeout` take effect when the native call returns, not during it.
+- Thumbnails. `C2PA.configure` gains `thumbnails`, `thumbnail_size`,
+  `thumbnail_format` and `thumbnail_quality`. When enabled, a thumbnail of the
+  asset is embedded in its manifest, and of each ingredient supplied as a file.
+  Off by default: c2pa-rs upscales to its long-edge setting, so at its default
+  of 1024 a 160×120 image gets a 1024×768 thumbnail ten times its own size.
+  Produced for JPEG, PNG, WebP and TIFF; other formats sign without one.
+
+### Changed
+
+- rb-sys is now a direct dependency of the native extension, for
+  `rb_thread_call_without_gvl`, which magnus does not wrap. It resolves to the
+  same copy magnus already uses.
+- The native extension is built with c2pa-rs's `add_thumbnails` feature, which
+  adds the `image` crate: 16 more crates, about 17 seconds on a cold compile,
+  and 1.5 MB on the compiled extension.
+
+## [0.4.0] — 2026-09-11
+
+Adds capability on top of 0.3.0. Nothing is removed and no existing call
+changes behaviour, so this is a minor release.
+
+### Added
+
+- Provenance chaining through ingredients. `add_ingredient` takes an optional
+  `file:`. When the file carries content credentials, its manifest is embedded
+  in the signed output and the ingredient points at it, so a verifier can follow
+  the chain from your asset back through the original. The description-only
+  form is unchanged.
+- `intent: :update` on `C2PA::Manifest`, for non-editorial changes such as
+  correcting metadata. The source file is the parent.
+- `C2PA.configure`, for trust and verification settings. Add a private CA's
+  root as a trust anchor and its certificates validate as `Trusted`; disable
+  `remote_manifest_fetch` and `ocsp_fetch` for environments without network
+  access. Only values you set are sent, so defaults are c2pa-rs's own.
+- Reading content credentials from PDFs. `C2PA.read` now parses a PDF and
+  returns its manifest if one is present. Signing a PDF remains impossible;
+  c2pa-rs has no PDF writer and upstream closed the request to add one.
+- `C2PA::InvalidSettingsError`, raised by `C2PA.configure` for unusable input.
+
+### Changed
+
+- c2pa-rs 0.90.15 → 0.90.22. The range includes security fixes: `h2` updated
+  for RUSTSEC-2026-0258, `chacha20` moved off a yanked version, hardening of
+  BMFF chunk-index handling and CAWG identity bindings. The lockfile ships in
+  the gem, so installers get these once they upgrade.
+- The native layer uses c2pa-rs's Context API rather than the deprecated
+  `Builder::from_json` and `Reader::from_file`, which read settings from
+  thread-local state. One shared Context is reused across calls. Signing from
+  several threads concurrently is now tested.
+- CI fails if a deprecated c2pa-rs API reappears.
+
+### Documentation
+
+- The certificate section no longer claims certificates must chain to a CA in
+  the C2PA trust list, or that self-signed certificates are rejected as such.
+  A private CA works; its certificates carry `signingCredential.untrusted`
+  until the root is added as an anchor. The certificate profile c2pa-rs
+  enforces is listed, including the Authority Key Identifier that
+  `openssl x509 -req` omits by default.
+- PDF is listed as read-only, with a note on what the test suite can and
+  cannot show: nothing available can produce a C2PA-signed PDF, so reading one
+  is untested here, though the code doing it is c2pa-rs's own.
+
 ## [0.3.0] — 2026-08-25
 
 Runs on c2pa-rs 0.90, and fixes every defect found while building a test suite
@@ -99,7 +183,9 @@ Tagged retroactively. See the v0.2.1 tag for the defects it shipped with.
 
 Tagged retroactively.
 
-[Unreleased]: https://github.com/eddorre/ruby-c2pa/compare/v0.3.0...HEAD
+[Unreleased]: https://github.com/eddorre/ruby-c2pa/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/eddorre/ruby-c2pa/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/eddorre/ruby-c2pa/compare/v0.3.0...v0.4.0
 [0.3.0]: https://github.com/eddorre/ruby-c2pa/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/eddorre/ruby-c2pa/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/eddorre/ruby-c2pa/releases/tag/v0.2.0

data/CONTRIBUTING.md

@@ -57,9 +57,15 @@ bundle exec ruby -Ilib -Itest test/c2pa_test.rb
 git checkout -- lib/c2pa/manifest.rb
 ```
 
+`git checkout --` is only safe if the file has no uncommitted changes of its
+own. Mid-change it reverts your work along with the mutation, and the suite
+then fails for a reason that has nothing to do with the test. Copy the file
+aside before mutating and restore from the copy, and run the unmutated suite
+afterwards as a control. That control run is what catches a bad restore.
+
 Then state it in the pull request:
 
-> Verified by reversing the title in `Manifest#to_json`: 19 failures, against 0
+> Verified by reversing the title in `Manifest#to_json`: 21 failures, against 0
 > for the unmutated suite.
 
 A broad mutation like that trips many tests, which is fine. A narrow one that
@@ -69,7 +75,7 @@ test is specific as well as present.
 Mutating the Rust in `ext/c2pa_native/` counts double — it proves the test
 reaches through the FFI boundary rather than stopping at Ruby.
 
-### Two traps, both hit while building this suite
+### Three traps, all hit while building this suite
 
 **A mutation that does not do what you think.** A NUL-handling test appeared to
 survive a mutation that stripped NUL bytes, which would have meant the test was
@@ -83,6 +89,17 @@ verdict rather than on our own code, mutate in both directions. A harness made
 to report no failures and a harness made to report spurious ones fail different
 tests; checking only one leaves the other half unverified.
 
+**A probe that measures the wrong thing.** The first two designs for the
+GVL tests looked at wall-clock effects: how long a Ruby thread stalled during
+a native call, and how much progress it made. Both reported the lock released
+when it was held, because `C2PA.sign`'s own `File.exist?` checks release the
+lock (stat does) and the wait to get it back swamped everything else. A
+`sample` of the process showed the main thread spending three quarters of its
+time waiting on the lock after a stat, not inside the native call. The test
+that works measures CPU parallelism, which waiting cannot inflate. When a
+timing test passes under the mutation it was written to catch, suspect the
+probe before the code.
+
 ## Where there is no oracle
 
 Most assertions can be checked against c2pa-rs, by signing a file and reading

data/README.md

@@ -64,22 +64,44 @@ The native Rust library is compiled automatically during installation. This take
 
 ## Preparing your certificate and key
 
-C2PA signing requires an X.509 certificate chain and private key in PEM format. The certificate must chain to a CA that is trusted by the C2PA ecosystem — **self-signed certificates are rejected by c2pa-rs**.
+C2PA signing requires an X.509 certificate chain and private key in PEM format.
+The certificate file contains the end-entity certificate first, then any
+intermediates, and must **not** include the root.
+
+c2pa-rs enforces a certificate profile. An end-entity certificate is rejected
+unless it carries all of:
+
+- Basic Constraints `CA:FALSE`, critical
+- Key Usage with `digitalSignature` or `nonRepudiation`, critical
+- an Extended Key Usage that is present and not `any`, critical
+- a Subject Key Identifier
+- an **Authority Key Identifier**
+
+The last one is easy to miss — `openssl x509 -req` omits it by default, and the
+certificate is then rejected with nothing more specific than
+`the certificate is invalid`.
+
+### Whose CA?
+
+A certificate from a CA in the C2PA trust list validates as `Trusted` with no
+configuration.
+
+A certificate from your own CA validates as `Valid` and carries
+`signingCredential.untrusted` — which does **not** make the manifest invalid.
+To have it treated as trusted, add your root as a trust anchor; see
+[Configuring trust](#configuring-trust).
 
 ### Development and testing
 
-The c2pa-rs project publishes test certificates that work for local development:
+The test suite generates its own certificates for every supported algorithm:
 
 ```bash
-curl -sL -o test_cert.pem https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/certs/es256.pub
-curl -sL -o test_key.pem  https://raw.githubusercontent.com/contentauth/c2pa-rs/main/sdk/tests/fixtures/certs/es256.pem
+bundle exec rake fixtures:certs
 ```
 
-Files signed with these test certificates will include a `signingCredential.untrusted` validation warning since the test CA is not in the public trust list, but are otherwise valid for development purposes.
-
-### Production
-
-Obtain a certificate from a CA trusted by the C2PA ecosystem. The certificate file must contain the full chain (end-entity certificate first, then any intermediates), but must **not** include the root CA.
+They land in `test/fixtures/certs/` and are not committed. See
+[`test/fixtures/generate_certs.rb`](test/fixtures/generate_certs.rb) for a
+worked example of building a chain c2pa-rs accepts.
 
 The supported signing algorithms are: `es256`, `es384`, `es512`, `ps256`, `ps384`, `ps512`, `ed25519`.
 
@@ -212,16 +234,42 @@ manifest.add_assertion(
 
 ### Adding ingredients
 
-Ingredients record the source assets a file was derived from:
+Ingredients record the source assets a file was derived from. Supply the file
+so c2pa-rs can read it:
 
 ```ruby
 manifest.add_ingredient(
   title:        "Original photo",
   format:       "image/jpeg",
-  instance_id:  "xmp:iid:original-uuid-here"
+  instance_id:  "xmp:iid:original-uuid-here",
+  relationship: "componentOf",
+  file:         "original.jpg"
 )
 ```
 
+If the ingredient already carries content credentials, its manifest is embedded
+in the signed output and the ingredient points at it. A verifier can then
+follow the chain from your asset back through the original. For a file with no
+credentials there is nothing to carry forward.
+
+Omitting `file:` records the description alone. Nothing binds it to any bytes,
+so a verifier cannot check the claim. That form is kept for compatibility;
+prefer the file.
+
+### Updating an existing asset
+
+For a non-editorial change to an asset, such as correcting metadata, use
+`intent: :update`. The source file is the parent, and the change is recorded
+against it without opening a new editing lineage:
+
+```ruby
+manifest = C2PA::Manifest.new(title: "Metadata corrected", intent: :update)
+  .add_action(C2PA::Actions::EDITED_METADATA)
+```
+
+c2pa-rs restricts this mode: there is exactly one ingredient, it is the source
+itself, and the hashed content must not change.
+
 ### Signing a file
 
 The `output` path must not already exist — `C2PA.sign` will raise a `C2PA::SigningError` if the file is already there.
@@ -275,6 +323,46 @@ C2PA.sign(
 )
 ```
 
+### Signing bytes in memory
+
+For data that never touches the filesystem, such as an upload held in a
+request body or an image your application generated, `C2PA.sign_buffer` takes
+the bytes and returns the signed bytes. The format must be given, since there
+is no filename to infer it from.
+
+```ruby
+signed = C2PA.sign_buffer(
+  data:        request.body.read,
+  format:      "image/jpeg",
+  certificate: "cert.pem",
+  key:         "key.pem",
+  manifest:    manifest
+)
+```
+
+The input must be a binary string (`Encoding::BINARY`, which is what
+`File.binread` and `IO#read` on a binary-mode stream return). A string tagged
+UTF-8 is rejected with an `ArgumentError` rather than transcoded, because a
+transcoded JPEG is a corrupt JPEG and nothing notices until a verifier rejects
+it. If you have such a string and know the bytes are intact, call `.b` on it.
+
+The same verify-after-sign guard applies. A result that does not validate is
+never returned; `C2PA::SigningError` is raised instead, and `verify: false`
+returns it anyway. `algorithm:` and everything on the manifest, including
+intents and ingredient files, work as they do for `C2PA.sign`.
+
+Memory is the trade-off. The input, the copy c2pa-rs works on, and the signed
+result on both sides of the Ruby boundary are resident at once at the peak,
+so budget about four times the size of the asset per call. For a photo that
+is nothing; for a feature-length video it is a reason to use `C2PA.sign` with
+paths instead.
+
+Signing and reading release Ruby's global VM lock while c2pa-rs works, so
+other threads in the process keep running. A threaded server signing a large
+video does not stall its other requests for the duration. One consequence:
+`Thread#kill` and `Timeout` cannot interrupt a native call in progress; they
+take effect when it returns.
+
 ### Reading a manifest
 
 ```ruby
@@ -285,6 +373,15 @@ puts active["title"]
 puts active["claim_generator_info"].first["name"]   # => "ruby-c2pa"
 ```
 
+From memory, `C2PA.read_buffer` takes the bytes. c2pa-rs identifies most
+formats from the leading bytes, so the format is optional; it is needed for a
+format with no signature to sniff, such as SVG.
+
+```ruby
+result = C2PA.read_buffer(data: signed)
+result = C2PA.read_buffer(data: svg_bytes, format: "image/svg+xml")
+```
+
 ### Naming your application
 
 Signed files credit `ruby-c2pa` by default. To credit your own application
@@ -307,8 +404,8 @@ The signed manifest then reads:
 {
   "name": "Acme Editor",
   "version": "2.0",
-  "org.rubygems.ruby_c2pa": "0.3.0",
-  "org.contentauth.c2pa_rs": "0.78.8"
+  "org.contentauth.c2pa_rs": "0.90.22",
+  "org.rubygems.ruby_c2pa": "0.5.0"
 }
 ```
 
@@ -322,12 +419,15 @@ calling application.
 ### Checking the SDK version
 
 ```ruby
-puts C2PA.sdk_version  # => "0.78.3"  (depends on the c2pa-rs version bundled with the gem)
+puts C2PA.sdk_version  # => "0.90.22"  (the c2pa-rs version the gem was built against)
 ```
 
 ### Error handling
 
-All errors inherit from `C2PA::Error`, so you can rescue broadly or narrowly:
+All errors inherit from `C2PA::Error`, so you can rescue broadly or narrowly.
+`SigningError` covers signing and the post-signing verification, `ReadError`
+reading, `InvalidManifestError` anything the builder rejects, and
+`InvalidSettingsError` anything `C2PA.configure` cannot use.
 
 ```ruby
 begin
@@ -344,6 +444,12 @@ rescue C2PA::ReadError => e
   puts "Could not read manifest: #{e.message}"
 end
 
+begin
+  C2PA.configure { |config| config.trust_anchors = "ca/root.pem" }
+rescue C2PA::InvalidSettingsError => e
+  puts "Settings not usable: #{e.message}"
+end
+
 # Or rescue any C2PA error broadly
 begin
   C2PA.sign(file: "photo.jpg", output: "photo_signed.jpg", certificate: "cert.pem", key: "key.pem", manifest: manifest)
@@ -352,14 +458,89 @@ rescue C2PA::Error => e
 end
 ```
 
+## Configuring trust
+
+c2pa-rs checks the signing certificate against a trust list, and reports
+`Trusted` when it chains to a root that list contains. That happens by default,
+so a certificate from a CA in the C2PA trust list needs no configuration.
+
+For a private or enterprise CA, add its root:
+
+```ruby
+C2PA.configure do |config|
+  config.trust_anchors = "ca/root.pem"   # a path, or the PEM text itself
+end
+```
+
+Files signed by a certificate chaining to it then validate as `Trusted` rather
+than carrying `signingCredential.untrusted`.
+
+### Offline and air-gapped environments
+
+Reading an asset may fetch a remote manifest over the network, and revocation
+checking may contact an OCSP responder. Both can be turned off:
+
+```ruby
+C2PA.configure do |config|
+  config.remote_manifest_fetch = false
+  config.ocsp_fetch            = false
+end
+```
+
+### Thumbnails
+
+c2pa-rs can embed a thumbnail of the asset in its manifest, and of each
+ingredient supplied as a file. Verify tools show it alongside the credentials.
+It is off unless you turn it on:
+
+```ruby
+C2PA.configure do |config|
+  config.thumbnails     = true
+  config.thumbnail_size = 512      # longest edge in pixels
+end
+```
+
+The default is off because c2pa-rs scales to a fixed long edge and upscales to
+reach it. Its own default is 1024, so a 160×120 image gets a 1024×768
+thumbnail, roughly ten times the size of the asset it describes. Set
+`thumbnail_size` no larger than your assets, or leave thumbnails off for small
+images.
+
+Thumbnails are produced for JPEG, PNG, WebP and TIFF. Other formats sign
+without one; c2pa-rs treats that as non-fatal.
+
+### Everything configurable
+
+| Setting | Default | Purpose |
+|---------|---------|---------|
+| `trust_anchors` | none | additional roots to trust, as PEM |
+| `trust_list` | C2PA list | replaces the trust list rather than adding to it |
+| `allowed_certificates` | none | explicitly allowed certificates, as PEM |
+| `verify_trust` | `true` | whether trust is checked at all |
+| `remote_manifest_fetch` | `true` | whether reading may fetch over the network |
+| `ocsp_fetch` | `false` | whether revocation is checked over OCSP |
+| `thumbnails` | `false` | embed a thumbnail of the asset and of file-backed ingredients |
+| `thumbnail_size` | 1024 | longest edge of the thumbnail, in pixels |
+| `thumbnail_format` | smallest | `:jpeg`, `:png` or `:gif` |
+| `thumbnail_quality` | `:medium` | `:low`, `:medium` or `:high` |
+
+Settings are global and apply to subsequent calls. Only values you set are
+sent, so anything left alone keeps c2pa-rs's own default, with one exception:
+`thumbnails` is always sent, because this gem's default differs from c2pa-rs's.
+`C2PA.configure` with no block resets everything.
+
+Turning `verify_trust` off means nothing is ever reported as untrusted, which
+in a library for establishing provenance is rarely what you want. It exists for
+environments that cannot reach a trust list at all.
+
 ## Supported file formats
 
 Each format below has a fixture and a signing test in the suite: the file is
 signed, read back, and asserted to validate.
 
-| Format | MIME type |
-|--------|-----------|
-| JPEG | `image/jpeg` |
+| Format | MIME type | |
+|--------|-----------|--|
+| JPEG | `image/jpeg` | |
 | PNG | `image/png` |
 | WebP | `image/webp` |
 | TIFF | `image/tiff` |
@@ -369,19 +550,31 @@ signed, read back, and asserted to validate.
 | MOV | `video/quicktime` |
 | MP3 | `audio/mpeg` |
 | WAV | `audio/wav` |
+| PDF | `application/pdf` | read only, see below |
 
 The format is detected automatically from the file extension.
 
 JPEG XL must be in the ISOBMFF container form. A bare codestream has no boxes
 to hold a manifest, and c2pa-rs rejects it.
 
-### Not supported
+### PDF is read-only
+
+`C2PA.read` works on a PDF that carries content credentials, such as one signed
+by Adobe Acrobat. `C2PA.sign` does not: c2pa-rs has no PDF writer at any
+version. `get_writer` returns `None` and `save_cai_store` returns
+`NotImplemented`, and upstream closed the request to expose one in December
+2025 (contentauth/c2pa-rs#527). Signing a PDF raises `C2PA::SigningError`
+with `type is unsupported`.
 
-**PDF cannot be signed.** c2pa-rs can read C2PA data out of a PDF but has no
-writer for it — `get_writer` returns `None` and `save_cai_store` returns
-`NotImplemented` — so `C2PA.sign` raises `C2PA::SigningError` with
-`type is unsupported`. This is true at every c2pa-rs version. Earlier releases
-of this gem listed PDF as supported; that was never correct.
+Earlier releases of this gem listed PDF as signable. That was never correct.
+
+One limit on what the test suite can show. It proves the PDF handler is active,
+by reading a PDF with no credentials and getting `no JUMBF data found` rather
+than `type is unsupported`. It cannot prove that a signed PDF returns its
+manifest, because nothing available can produce one: c2pa-rs cannot write
+them, and no local tool can either. The code doing the reading is c2pa-rs's
+own and is tested upstream; what is untested here is only this gem's
+integration with the success path.
 
 ### Test fixtures
 
@@ -417,20 +610,35 @@ Ruby (C2PA.sign)
     ▼
 Rust (C2PA::Native.sign_file)
     │
-    │  calls c2pa-rs Builder API
+    │  c2pa-rs Builder, through a shared Context
     ▼
 c2pa-rs — embeds signed manifest into the file
 ```
 
-The Rust extension (`ext/c2pa_native/src/lib.rs`) defines `C2PA::Native` with three methods:
+The Rust extension (`ext/c2pa_native/src/lib.rs`) defines `C2PA::Native` with six methods:
 
 | Method | Description |
 |--------|-------------|
-| `C2PA::Native.sign_file` | Sign a file and write the result |
+| `C2PA::Native.sign_file` | Sign a file and write the result. Takes the manifest JSON, an optional intent, and any ingredient files |
+| `C2PA::Native.sign_buffer` | The same over bytes: a binary string in, the signed binary string out |
 | `C2PA::Native.read_file` | Read and return the manifest JSON |
+| `C2PA::Native.read_buffer` | The same over bytes, with an optional format hint |
+| `C2PA::Native.configure` | Replace the shared c2pa-rs Context with one built from a settings document |
 | `C2PA::Native.sdk_version` | Return the c2pa-rs version string |
 
-Input validation (missing files, invalid manifests) is handled in Ruby before calling into Rust. Errors from the native layer are caught and re-raised as typed `C2PA::Error` subclasses.
+All four run with the global VM lock released, so other Ruby threads are not
+blocked while c2pa-rs hashes and signs. The bytes and paths are copied out of
+Ruby before the lock goes, and the result is turned into a Ruby object after
+it is back; nothing in between touches the interpreter.
+
+Signing and reading go through one c2pa-rs `Context`, built once and shared
+across threads. `C2PA.configure` replaces it rather than mutating it, so a
+signing call already in flight keeps the settings it started with.
+
+Input validation (missing files, invalid manifests, unreadable ingredient
+files, unusable settings) is handled in Ruby before calling into Rust. Errors
+from the native layer are caught and re-raised as typed `C2PA::Error`
+subclasses.
 
 ## Contributing