c2pa 0.91.8

Rust SDK for C2PA (Coalition for Content Provenance and Authenticity) implementors
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

// Copyright 2024 Adobe. All rights reserved.
// This file is licensed to you under the Apache License,
// Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
// or the MIT license (http://opensource.org/licenses/MIT),
// at your option.

// Unless required by applicable law or agreed to in writing,
// this software is distributed on an "AS IS" BASIS, WITHOUT
// WARRANTIES OR REPRESENTATIONS OF ANY KIND, either express or
// implied. See the LICENSE-MIT and LICENSE-APACHE files for the
// specific language governing permissions and limitations under
// each license.

#![allow(clippy::expect_used)]
#![allow(clippy::panic)]
#![allow(clippy::unwrap_used)]

mod claim_aggregation;
#[cfg(not(target_arch = "wasm32"))]
mod embeddable_signing;
mod examples;
pub(crate) mod fixtures;
mod validation_method;

/// The `did:jwk` issuer that the bundled CAWG ICA `ica_validation` fixtures are
/// signed with.
pub(crate) const ICA_FIXTURE_JWK_ISSUER: &str = "did:jwk:eyJhbGciOiJFZERTQSIsImt0eSI6Ik9LUCIsImNydiI6IkVkMjU1MTkiLCJ4IjoiTXA1LTBlODNuTmdRaGRoQlc4UnNoa2p5OTBzYTFBOUpJemtJdGNEcUN1SSJ9";

/// The `did:web` issuer that the Adobe connected-identities fixtures are signed
/// with.
pub(crate) const ICA_FIXTURE_WEB_ISSUER: &str =
    "did:web:connected-identities.identity-stage.adobe.com";

/// A [`Context`](crate::Context) whose `trust.trusted_ica_issuers`
/// allow-list trusts the issuers used by the bundled CAWG ICA test fixtures.
///
/// Tests that exercise a directly-constructed
/// [`IcaSignatureVerifier`](crate::identity::claim_aggregation::IcaSignatureVerifier)
/// build it from this context (`IcaSignatureVerifier::new(&ica_test_context())`)
/// so that an otherwise-valid fixture is treated as having a trusted issuer (and
/// therefore produces `cawg.ica.credential_valid`). To exercise the
/// untrusted-issuer path, build a verifier from a context with a different (or
/// empty) allow-list, such as `Context::new()`.
pub(crate) fn ica_test_context() -> crate::Context {
    let mut settings = crate::settings::Settings::default();
    if let Some(anchors) = &mut settings.trust.anchors {
        // make sure there is a CAWG trust anchor with the ICA fixture issuers.
        let mut cawg_anchor = anchors[0].clone();
        cawg_anchor.trust_kind = crate::settings::TrustListKind::CAWG;
        cawg_anchor.trusted_ica_issuers = Some(vec![
            ICA_FIXTURE_JWK_ISSUER.to_string(),
            ICA_FIXTURE_WEB_ISSUER.to_string(),
        ]);
        cawg_anchor.trust_uri = Some("cawg_trust".to_string());

        anchors.push(cawg_anchor);
    }

    crate::Context::new().with_settings(settings).unwrap()
}

/// Read a manifest store with identity assertion decoding disabled so the raw
/// assertion bytes are preserved for manual validation in tests.
pub(crate) async fn read_manifest<R: std::io::Read + std::io::Seek + Send>(
    format: &str,
    source: &mut R,
) -> crate::Reader {
    let settings = crate::settings::Settings::default()
        .with_value("core.decode_identity_assertions", false)
        .unwrap();
    let context = crate::Context::new()
        .with_settings(settings)
        .unwrap()
        .into_shared();
    crate::Reader::from_shared_context(&context)
        .with_stream_async(format, source)
        .await
        .unwrap()
}