c2pie 0.1.0__py3-none-any.whl

c2pie/c2pa/assertion.py

@@ -0,0 +1,96 @@
+from __future__ import annotations
+
+from typing import Any
+
+from c2pie.jumbf_boxes.content_box import ContentBox
+from c2pie.jumbf_boxes.super_box import SuperBox
+from c2pie.utils.assertion_schemas import (
+    C2PA_AssertionTypes,
+    cbor_to_bytes,
+    get_assertion_content_box_type,
+    get_assertion_content_type,
+    get_assertion_label,
+    json_to_bytes,
+)
+from c2pie.utils.content_types import jumbf_content_types
+
+
+class Assertion(SuperBox):
+    """Universal assertion superbox (one content box)."""
+
+    def __init__(
+        self,
+        assertion_type: C2PA_AssertionTypes,
+        schema: dict[str, Any],
+    ):
+        self.type = assertion_type
+        self.schema = schema
+
+        payload = self.get_payload_from_schema()
+        box_type_hex = get_assertion_content_box_type(self.type)
+        content_box = ContentBox(box_type=box_type_hex, payload=payload)
+
+        super().__init__(
+            content_type=get_assertion_content_type(self.type),
+            label=get_assertion_label(self.type),
+            content_boxes=[content_box],
+        )
+
+    def get_payload_from_schema(self) -> bytes:
+        ctype = get_assertion_content_type(self.type)
+        if ctype == jumbf_content_types["json"]:
+            return json_to_bytes(self.schema)
+        if ctype == jumbf_content_types["cbor"]:
+            return cbor_to_bytes(self.schema)
+        if ctype == jumbf_content_types["codestream"]:
+            return self.schema.get("payload", b"")
+        return b""
+
+    def get_data_for_signing(self) -> bytes:
+        return self.description_box.serialize() + self.serialize_content_boxes()
+
+
+class HashDataAssertion(Assertion):
+    """c2pa.hash.data hard binding assertion."""
+
+    def __init__(
+        self,
+        cai_offset: int,
+        hashed_data: bytes,
+        additional_exclusions: list[dict[str, int]] | None = None,
+    ):
+        exclusions: list[dict[str, int]] = [{"start": cai_offset, "length": 65535}]
+        if additional_exclusions:
+            exclusions.extend(additional_exclusions)
+
+        schema: dict[str, Any] = {
+            "name": "jumbf manifest",
+            "exclusions": exclusions,
+            "alg": "sha256",
+            "hash": hashed_data,
+            "pad": [],
+        }
+        super().__init__(C2PA_AssertionTypes.data_hash, schema)
+
+    def set_hash_data_length(self, length: int) -> None:
+        if self.schema.get("name") != "jumbf manifest":
+            raise ValueError("c2pa.hash.data: jumbf manifest is missing")
+        exclusions = self.schema.get("exclusions", [])
+        if not exclusions:
+            raise ValueError("c2pa.hash.data: exclusions are missing")
+        exclusions[0]["length"] = int(length)
+
+        payload = self.get_payload_from_schema()
+        if self.content_boxes:
+            self.content_boxes[0] = ContentBox(
+                box_type=get_assertion_content_box_type(self.type),
+                payload=payload,
+            )
+        else:
+            self.content_boxes = [
+                ContentBox(
+                    box_type=get_assertion_content_box_type(self.type),
+                    payload=payload,
+                )
+            ]
+        self.sync_payload()

c2pie/c2pa/assertion_store.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from c2pie.jumbf_boxes.super_box import SuperBox
+from c2pie.utils.assertion_schemas import C2PA_AssertionTypes
+from c2pie.utils.content_types import c2pa_content_types
+
+
+class AssertionStore(SuperBox):
+    def __init__(
+        self,
+        assertions: list,
+    ):
+        self.assertions = assertions
+        super().__init__(
+            content_type=c2pa_content_types["assertions"],
+            label="c2pa.assertions",
+            content_boxes=self.assertions,
+        )
+
+    def get_assertions(self) -> list:
+        return self.assertions
+
+    def set_hash_data_length(
+        self,
+        length: int,
+    ) -> None:
+        for assertion in self.assertions:
+            if assertion.type == C2PA_AssertionTypes.data_hash:
+                assertion.set_hash_data_length(length)
+        self.sync_payload()

c2pie/c2pa/claim.py

@@ -0,0 +1,136 @@
+from __future__ import annotations
+
+import hashlib
+import uuid
+from typing import Any
+
+import cbor2
+
+from c2pie.c2pa.assertion_store import AssertionStore
+from c2pie.jumbf_boxes.content_box import ContentBox
+from c2pie.jumbf_boxes.super_box import SuperBox
+from c2pie.utils.content_types import c2pa_content_types
+
+
+def _sha256(b: bytes) -> bytes:
+    return hashlib.sha256(b).digest()
+
+
+class Claim(SuperBox):
+    """Claim (c2pa.claim) as a JUMBF superbox with one CBOR content box."""
+
+    def __init__(
+        self,
+        assertion_store: AssertionStore,
+        claim_generator: str = "c2pie",
+        manifest_label: str = f"urn:uuid:{uuid.uuid4().hex}",
+        dc_format: str = None,
+    ):
+        self.claim_generator = claim_generator
+        self.manifest_label = manifest_label
+        self.assertion_store = assertion_store
+        self.dc_format = dc_format
+
+        self.claim_signature_label = f"self#jumbf=c2pa/{self.manifest_label}/c2pa.signature"
+
+        self._instance_id = f"xmp:iid:{uuid.uuid4()}"
+
+        cbor_payload = self._build_cbor_payload()
+
+        content_box = ContentBox(
+            box_type=b"cbor".hex(),
+            payload=cbor_payload,
+        )
+        super().__init__(
+            content_type=c2pa_content_types["claim"],
+            label="c2pa.claim",
+            content_boxes=[content_box],
+        )
+
+    def get_cbor_payload(self) -> bytes:
+        """CBOR bytes, on top of which COSE (detached) is signed."""
+        return self.content_boxes[0].get_payload()
+
+    def get_manifest_label(self) -> str:
+        return self.manifest_label
+
+    def set_assertion_store(self, assertion_store) -> None:
+        """
+        Called from Manifest when assertions are changed (including when length is updated in c2pa.hash.data).
+        Reassemble the CBOR payload of the stamp with the correct hashed URIs.
+        """
+        self.assertion_store = assertion_store
+        self._rebuild_payload()
+
+    def set_format(self, dc_format: str | None) -> None:
+        self.dc_format = dc_format
+        self._rebuild_payload()
+
+    def _build_assertions_array(self) -> list[dict[str, Any]]:
+        """
+        Build the claim[‘assertions’] array from the current AssertionStore:
+          - url:  self#jumbf=/c2pa/<manifest_label>/c2pa.assertions/<label>
+          - alg:  sha256
+          - hash: sha256( JUMBF-superbox-content = description + content_boxes ) for this assertion
+        """
+        out: list[dict[str, Any]] = []
+        if not self.assertion_store:
+            return out
+
+        assertions = getattr(self.assertion_store, "assertions", None)
+        if assertions is None and hasattr(self.assertion_store, "get_assertions"):
+            assertions = self.assertion_store.get_assertions()
+        if not assertions:
+            return out
+
+        for assertion in assertions:
+            label = getattr(assertion, "label", None)
+            if label is None and hasattr(assertion, "get_label"):
+                label = assertion.get_label()
+
+            if hasattr(assertion, "get_data_for_signing"):
+                data = assertion.get_data_for_signing()
+            else:
+                data = assertion.description_box.serialize() + assertion.serialize_content_boxes()
+
+            out.append(
+                {
+                    "url": f"self#jumbf=/c2pa/{self.manifest_label}/c2pa.assertions/{label}",
+                    "alg": "sha256",
+                    "hash": _sha256(data),
+                }
+            )
+        return out
+
+    def _build_cbor_payload(self) -> bytes:
+        """
+        Canonical CBOR content claim.
+        Include:
+          - claim_generator
+          - instanceID (stable for the object)
+          - signature (reference to c2pa.signature)
+          - optional dc:format
+          - optional assertions (if there is an assertion_store)
+        """
+        claim: dict[str, Any] = {
+            "claim_generator": self.claim_generator,
+            "instanceID": self._instance_id,
+            "signature": self.claim_signature_label,
+            "alg": "sha256",
+        }
+        if self.dc_format:
+            claim["dc:format"] = self.dc_format
+
+        assertions_arr = self._build_assertions_array()
+        if assertions_arr:
+            claim["assertions"] = assertions_arr
+
+        return cbor2.dumps(claim, canonical=True)
+
+    def _rebuild_payload(self) -> None:
+        new_payload = self._build_cbor_payload()
+        self.content_boxes[0] = ContentBox(
+            box_type=b"cbor".hex(),
+            payload=new_payload,
+        )
+        self.sync_payload()

c2pie/c2pa/claim_signature.py

@@ -0,0 +1,101 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+
+import cbor2
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding
+from cryptography.hazmat.primitives.serialization import Encoding
+
+from c2pie.c2pa.claim import Claim
+from c2pie.jumbf_boxes.content_box import ContentBox
+from c2pie.jumbf_boxes.super_box import SuperBox
+from c2pie.utils.content_types import c2pa_content_types
+
+
+def _split_pem_certs_to_der(pem_bytes: bytes) -> list[bytes]:
+    if not pem_bytes:
+        return []
+    blocks = re.findall(
+        b"-----BEGIN CERTIFICATE-----\\s.*?-----END CERTIFICATE-----\\s*",
+        pem_bytes,
+        flags=re.DOTALL,
+    )
+    ders: list[bytes] = []
+    for blk in blocks:
+        cert = x509.load_pem_x509_certificate(blk)
+        ders.append(cert.public_bytes(Encoding.DER))
+    return ders
+
+
+class ClaimSignature(SuperBox):
+    """
+    COSE_Sign1 (PS256), detached:
+      - protected: {1:-37, 33:[x5chain DER...]}
+      - unprotected: {}
+      - COSE payload = nil
+      - Sig_structure payload = bstr(Claim CBOR)
+    """
+
+    def __init__(
+        self,
+        claim: Claim,
+        *,
+        private_key: bytes,
+        certificate_pem_bundle: bytes = None,
+        certificate: bytes = None,
+    ):
+        if certificate_pem_bundle is None and certificate is not None:
+            certificate_pem_bundle = certificate
+
+        self.claim = claim
+        self.private_key = private_key
+        self.certificate = certificate_pem_bundle
+
+        content_boxes = self._generate_payload()
+        super().__init__(
+            content_type=c2pa_content_types["claim_signature"],
+            label="c2pa.signature",
+            content_boxes=content_boxes,
+        )
+
+    def _generate_payload(self) -> list[ContentBox]:
+        if not (self.claim and self.private_key and self.certificate):
+            return []
+
+        cose_tagged = self._create_cose_sign1()
+        return [ContentBox(box_type=b"cbor".hex(), payload=cose_tagged)]
+
+    def set_claim(self, claim: Claim):
+        self.claim = claim
+        content_boxes = self._generate_payload()
+        super().__init__(
+            content_type=c2pa_content_types["claim_signature"],
+            label="c2pa.signature",
+            content_boxes=content_boxes,
+        )
+
+    def _generate_protected_header(self) -> bytes:
+        der_chain = _split_pem_certs_to_der(self.certificate or b"")
+        protected: dict[int, Any] = {1: -37}
+        if der_chain:
+            protected[33] = der_chain
+        return cbor2.dumps(protected, canonical=True)
+
+    def _create_cose_sign1(self) -> bytes:
+        phdr_serialized = self._generate_protected_header()
+        claim_cbor = self.claim.get_cbor_payload()
+        sig_structure = ["Signature1", phdr_serialized, b"", claim_cbor]
+        to_sign = cbor2.dumps(sig_structure, canonical=True)
+
+        key = serialization.load_pem_private_key(self.private_key, password=None)
+        signature = key.sign(  # type: ignore
+            to_sign,
+            padding.PSS(mgf=padding.MGF1(hashes.SHA256()), salt_length=32),  # type: ignore
+            hashes.SHA256(),  # type: ignore
+        )
+
+        cose_msg = [phdr_serialized, {}, None, signature]
+        return cbor2.dumps(cbor2.CBORTag(18, cose_msg), canonical=True)

c2pie/c2pa/config.py

@@ -0,0 +1 @@
+RETRY_SIGNATURE = 8  # max retries, might be terminated earliers

c2pie/c2pa/manifest.py

@@ -0,0 +1,56 @@
+import uuid
+
+from c2pie.jumbf_boxes.super_box import SuperBox
+from c2pie.utils.content_types import c2pa_content_types
+
+
+class Manifest(SuperBox):
+    """
+    C2PA Manifest: Assertion Store + Claim + Claim Signature.
+    The manifest label is compatible with c2patool: urn:uuid:<uuid-hex>
+    """
+
+    def __init__(
+        self,
+        manifest_label: str = f"urn:uuid:{uuid.uuid4().hex}",
+    ):
+        self.manifest_label = manifest_label
+        self.claim = None
+        self.claim_signature = None
+        self.assertion_store = None
+
+        super().__init__(content_type=c2pa_content_types["default_manifest"], label=self.manifest_label)
+
+    def set_claim(self, claim):
+        self.claim = claim
+        self.add_content_box(self.claim)
+
+    def set_claim_signature(self, claim_signature):
+        self.claim_signature = claim_signature
+        self.add_content_box(self.claim_signature)
+
+    def set_assertion_store(self, assertion_store):
+        self.assertion_store = assertion_store
+        self.add_content_box(self.assertion_store)
+
+    def get_manifest_label(self):
+        return self.manifest_label
+
+    def get_assertions(self):
+        if self.assertion_store:
+            return self.assertion_store.get_assertions()
+        return
+
+    def set_hash_data_length(self, length: int):
+        """
+        Updates the length of exceptions in HashData, reassembles Claim (assertion hashes)
+        and ClaimSignature (COSE Sign1 detached over Claim CBOR).
+        """
+        if self.assertion_store and self.claim and self.claim_signature:
+            self.assertion_store.set_hash_data_length(length)
+
+            self.claim.set_assertion_store(self.assertion_store)
+
+            self.claim_signature.set_claim(self.claim)
+
+        self.sync_payload()

c2pie/c2pa/manifest_store.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from c2pie.jumbf_boxes.super_box import SuperBox
+from c2pie.utils.content_types import c2pa_content_types
+
+
+class ManifestStore(SuperBox):
+    """
+    C2PA Manifest Store (JUMBF superbox) with one or more Manifest.
+    IMPORTANT: here we do NOT "assume" length of specific manifest bytes (JPG/PDF, etc.).
+    For PDF, the length of the exception is set by the injector; for JPG, by its own injector.
+    """
+
+    def __init__(self, manifests: list | None = None):
+        self.manifests: list = [] if manifests is None else manifests
+        super().__init__(
+            content_type=c2pa_content_types["manifest_store"],
+            label="c2pa",
+            content_boxes=self.manifests,
+        )
+
+    def sync_payload(self):
+        super().sync_payload()
+
+    def set_hash_data_length_for_all(
+        self,
+        length: int,
+    ) -> None:
+        for manifest in self.manifests:
+            manifest.set_hash_data_length(length)
+        super().sync_payload()
+
+    def serialize(self) -> bytes:
+        return super().serialize()

c2pie/c2pa_injection/jpg_injection.py

@@ -0,0 +1,100 @@
+JPG_SEGMENT_MAX_PAYLOAD_LENGTH = 65517
+
+
+class JpgSegment:
+    def __init__(
+        self,
+        payload_length: int,
+        marker: bytes = bytes.fromhex("EB"),
+    ):  # noqa: B008
+        self.marker = marker
+        self.payload_length = payload_length
+
+    def get_segment_length(self):
+        return self.payload_length + 2  # payload length + size of payload length
+
+    def serialize(
+        self,
+        payload: bytes,
+    ):
+        serialized_data = b""
+
+        serialized_data += bytes.fromhex("FF") + self.marker
+        serialized_data += self.get_segment_length().to_bytes(2, "big")
+        serialized_data += payload
+
+        return serialized_data
+
+
+class JpgSegmentApp11(JpgSegment):
+    def __init__(self, segment_id, sequence_number, payload_length, payload):
+        self.ci = bytes.fromhex(b"JP".hex())  # 2 bytes
+        self.en = segment_id  # 2 bytes
+        self.z = sequence_number  # 4 bytes
+
+        self.app11_payload = payload
+
+        super().__init__(payload_length=self.get_payload_length(payload_length))
+
+    def get_payload_length(self, payload_length):
+        return 2 + 2 + 4 + 4 + 4 + payload_length
+
+    def serialize(self, payload=None):
+        _en = self.en.to_bytes(2, "big")
+        _z = self.z.to_bytes(4, "big")
+
+        app11_payload = self.ci + _en + _z + self.app11_payload
+
+        return super().serialize(app11_payload)
+
+
+class JpgSegmentApp11Storage:
+    def __init__(
+        self,
+        app11_segment_box_length: int,
+        app11_segment_box_type: str,
+        payload: bytes,
+    ):
+        self.l_box = app11_segment_box_length
+        self.t_box = app11_segment_box_type
+        self.payload = payload
+        self.serialized_length = 0
+
+    def get_payload_length(self):
+        return self.l_box - 4 - 4  # - t_box_length - l_box_length
+
+    def get_serialized_length(self):
+        return self.serialized_length
+
+    def serialize(self):
+        segment_id = 1
+        sequence_number = 0
+        payload_offset = 0
+
+        payload_length = self.get_payload_length()
+
+        app11_segments = []
+
+        while payload_length > 0:
+            sequence_number += 1
+            chunk_length = JPG_SEGMENT_MAX_PAYLOAD_LENGTH
+            if payload_length < JPG_SEGMENT_MAX_PAYLOAD_LENGTH:
+                chunk_length = payload_length
+
+            app11_segments.append(
+                JpgSegmentApp11(
+                    segment_id=segment_id,
+                    sequence_number=sequence_number,
+                    payload_length=chunk_length,
+                    payload=self.payload[payload_offset:],
+                )
+            )
+            payload_length -= chunk_length
+            payload_offset += chunk_length
+
+        serialized_storage_data = b""
+        for app11_segment in app11_segments:
+            serialized_storage_data += app11_segment.serialize()
+
+        self.serialized_length = len(serialized_storage_data)
+        return serialized_storage_data