Module hardbinding 

The c2pa.hash.data hard binding for HTML documents.

Coverage

• Inline manifest: one exclusion range covering the entire script element, <script through </script> inclusive. The hash is over the document with that range removed.
• External manifest: no exclusion range at all. The hash is over the entire document, link element included.

The hash is defined over the bytes of the document as stored, with no normalization of any kind. Anything that re-serializes the HTML — a CMS, a CDN, a formatter that rewrites quote styles or collapses whitespace — shifts byte offsets and invalidates the binding. That is by design: re-serialization is a content modification. A generator in such a pipeline embeds after the final serialization step, or uses an external manifest.

Contrast the text bindings, which normalize: A.9 hashes raw file bytes because structured text is byte-stable on disk, and A.8 normalizes to NFC because clipboard-portable text may arrive in any normalization form. HTML is a file, so it is bytes.

The inline hash can be computed before the manifest exists

Because the exclusion covers the entire script element, the covered bytes are the document with the element cut out — which, for an element that was inserted rather than edited, is the original document. So a generator does not need the placeholder-reserve-then-fill dance other formats require: hash the document, sign, then embed. inline_hash_before_embed is that shortcut, and compute_data_hash on the embedded result agrees with it.

An external manifest has no exclusion, so the link element is inside the hash and the order is reversed: insert the link first, then hash.

Dependency-free

Sha2 implements all three C2PA digest algorithms in-crate, so the binding works out of the box with nothing pulled in. Hashing still goes through the Hasher trait, so a caller with a reason to substitute — an accelerated or hardware-backed digest, or one already provided by the host runtime — passes their own instead.

Structs

DataHash

A computed c2pa.hash.data assertion.

Exclusion

A byte range excluded from the data hash, matching the EXCLUSION_RANGE-map CDDL (start, length). Offsets are into the document as stored.

Sha2

The built-in Hasher: SHA-256, SHA-384, and SHA-512 per FIPS 180-4, implemented in-crate so the binding pulls in no dependency.

Enums

Algorithm

A C2PA-allowed hash algorithm for the data hash.

Constants

DATA_HASH_LABEL

The assertion label for the hard binding.

Traits

Hasher

A digest implementation. Sha2 is the built-in one; the trait exists so a caller can substitute an accelerated or host-provided digest without the binding algorithm depending on either.

Functions

apply_exclusions

Remove exclusions from html, validating that they are ordered, non-overlapping, and within bounds.

compute_data_hash

Compute the hard binding for html: locate the manifest element, exclude it if it is inline, and hash what the exclusions leave.

inline_hash_before_embed

The hash an inline binding will have once a script element is embedded in html, computed before the manifest exists.

manifest_exclusions

The exclusion ranges for the document’s manifest association.

verify_data_hash

Verify a c2pa.hash.data binding against html, following the validator procedure: apply the assertion’s own exclusion ranges, recompute, compare.