pub struct VerifyOptions {Show 30 fields
pub trust_pem: Option<String>,
pub claim_trust_sources: Option<Vec<TrustListSource>>,
pub tsa_trust_pem: Option<String>,
pub tsa_trust_sources: Option<Vec<TrustListSource>>,
pub allowed_list_pem: Option<String>,
pub cawg_trust_pem: Option<String>,
pub cawg_allowed_certs_pem: Option<String>,
pub cawg_document_signing_require_anchor: Option<bool>,
pub cawg_trust_configurations: Option<Vec<CawgTrustConfiguration>>,
pub trust_anchor_not_before: Option<String>,
pub trust_anchor_not_after: Option<String>,
pub no_default_trust: bool,
pub cawg_did_documents: Option<HashMap<String, Value>>,
pub cawg_ica_trusted_issuers: Option<Vec<String>>,
pub cawg_ica_trust_anchors: Option<Vec<String>>,
pub cawg_ica_status_lists: Option<HashMap<String, String>>,
pub ocsp_responses: Option<HashMap<String, String>>,
pub ocsp_unreachable: Option<Vec<String>>,
pub external_data: Option<HashMap<String, String>>,
pub external_data_media_types: Option<HashMap<String, String>>,
pub external_data_unreachable: Option<Vec<String>>,
pub expected_seek_positions: Vec<usize>,
pub spec_version: Option<String>,
pub strict_conformance: bool,
pub cawg_strict_encoding: bool,
pub validation_time: Option<String>,
pub stream_presentation_times: Option<Vec<String>>,
pub telemetry: TelemetryOptions,
pub online: Option<bool>,
pub online_allow_private_networks: bool,
}Fields§
§trust_pem: Option<String>PEM bundle of claim-signing trust anchors.
claim_trust_sources: Option<Vec<TrustListSource>>Claim-signing trust lists with reliable source metadata for C2PA 2.5 crJSON. Each source remains separate until the matching anchor is known.
tsa_trust_pem: Option<String>PEM bundle of timestamp-authority trust anchors.
tsa_trust_sources: Option<Vec<TrustListSource>>Timestamp-authority trust lists with reliable source metadata for C2PA 2.5 crJSON. These certificates never enter the claim-signing store.
allowed_list_pem: Option<String>PEM bundle of directly allowed end-entity certificates.
cawg_trust_pem: Option<String>PEM bundle of trust anchors for CAWG named-actor (identity) X.509
credentials. None leaves identity signers untrusted (their
well-formedness is still validated).
cawg_allowed_certs_pem: Option<String>PEM bundle of directly allowed CAWG end-entity certificates.
cawg_document_signing_require_anchor: Option<bool>Require an id-kp-documentSigning CAWG credential to chain to a
configured anchor or appear on the allowed list. None keeps the
default, true.
cawg_trust_configurations: Option<Vec<CawgTrustConfiguration>>Typed CAWG trust configurations, one per source. Each carries its
profile and its own trust window; see CawgTrustConfiguration.
Appended after cawg_trust_pem/cawg_allowed_certs_pem, in order.
trust_anchor_not_before: Option<String>RFC 3339 start of trust for caller-supplied PEM anchors. Before this
instant those anchors do not validate a signature, whatever the anchor
certificate’s own notBefore says. Bundled snapshots and typed
cawg_trust_configurations are unaffected.
trust_anchor_not_after: Option<String>RFC 3339 end of trust for caller-supplied PEM anchors. After this
instant those anchors no longer validate a signature. Bundled snapshots
and typed cawg_trust_configurations are unaffected.
no_default_trust: boolDisable the bundled C2PA, IPTC, and Encypher trust snapshots. By
default, caller-supplied PEM bundles extend those snapshots; setting
this to true evaluates only caller-supplied trust material.
cawg_did_documents: Option<HashMap<String, Value>>Pinned offline DID-document store for CAWG ICA issuers, keyed by primary DID (no fragment). Resolution never touches the network.
cawg_ica_trusted_issuers: Option<Vec<String>>ICA issuer DIDs trusted directly by the caller.
cawg_ica_trust_anchors: Option<Vec<String>>Trusted DID controller anchors. Issuers may trace to these anchors
through controller links in caller-pinned DID documents.
cawg_ica_status_lists: Option<HashMap<String, String>>Offline, decompressed revocation bitstrings keyed by
credentialStatus.statusListCredential URI and encoded as standard
base64. Missing lists fail closed without network access.
ocsp_responses: Option<HashMap<String, String>>OCSP responses a caller obtained online, keyed by the lowercase hex
SHA-256 of the certificate’s DER and encoded as standard base64 of the
DER OCSPResponse. An empty decoded value is the sentinel for a
response body that arrived but was discarded under a size bound; it is
received, unusable evidence rather than an unreachable responder.
The SDK never fetches these for you at this layer: supply them from your own OCSP client, or let the SDK’s consent-gated fetcher do it. A response is trusted no further than any other input - it must still be signed by an authorized responder for the certificate in question, and it is evaluated under the C2PA 2.4 and CAWG 1.3 online rules.
ocsp_unreachable: Option<Vec<String>>Certificates whose OCSP responder was queried but delivered no
response, by the same lowercase hex SHA-256 key. A response that
arrived but was unusable belongs in ocsp_responses.
Each entry registers signingCredential.ocsp.inaccessible or, for a
CAWG identity, cawg.x509.ocsp.inaccessible, in place of the
ocsp.skipped code a purely offline run reports.
external_data: Option<HashMap<String, String>>Content of cloud-data and hashed external-reference assertions, keyed by the URI the assertion declares and encoded as standard base64.
The bytes are hashed against the assertion’s own alg/hash pair
before anything else is done with them.
external_data_media_types: Option<HashMap<String, String>>Media types observed while retrieving external_data, keyed by the
same URI. Linked-resource integrity uses this to evaluate dc:format;
bytes without an observed type cannot be reported as a format match.
external_data_unreachable: Option<Vec<String>>External-resource URIs for which retrieval was attempted but yielded no
usable body. Linked-resource integrity reports these as inaccessible
rather than as resources the validator chose to skip.
expected_seek_positions: Vec<usize>Zero-based indexes into supplied fragments or stream segments where the player expects a discontinuity. Values must be unique, strictly increasing, and in bounds. Ignored by single-asset verification.
spec_version: Option<String>C2PA validation policy: "2.2", "2.4", or "2.5". None is the
default and is identical to "2.4", preserving current behavior and
report bytes. The caller selects this policy; a claim’s declared
specVersion never selects or upgrades it.
"2.5" validates under the published C2PA 2.5 standard (specs-core
tag 2.5, d538a737): its text-carrier locating rules, padding admission,
action and assertion-metadata time checks, relatedAssertions, linked
resource integrity, claim.actions.missing,
manifest.inaccessible.malformed, BMFF hash rules, and the ESP claim
signature algorithms. Reports carry profile: "c2pa-2.5". With
strict_conformance, 2.5 uses strict technical validation under the
core-spec compliance bar; this is not a certified or published
Conformance Program profile. It also reads the carriers 2.5 adds
(append-only text, WARC, MIDI, TTML, ONNX, SafeTensors, Parquet,
BlockFact, WebVTT and other structured text) and validates
c2pa.hash.segment bindings; see supported_mime_types_for.
Any other value fails with Error::UnsupportedSpecVersion before
asset I/O. The policy is never inferred from what a manifest declares.
strict_conformance: boolApply strict technical validation. Under the default 2.4 policy this is
the C2PA 2.4 Conformance Program posture, including its upgraded SHOULD
requirements. Under the 2.5 policy it selects conformance mode with the
core-spec compliance bar and strict diagnostics; it does not claim
certified scope or an unpublished 2.5 Conformance Program. The flag
also requires CAWG Identity 1.3 deterministic signer_payload CBOR; the
default accepts the CAWG 1.1 field order with
com.encypher.cawg.legacyProfile.
cawg_strict_encoding: boolRefuse the CAWG field-order signer_payload encoding that c2pa-rs
writes, without applying the rest of the conformance posture. When
unset, the default accepts it with the informational
com.encypher.cawg.legacyProfile; strict_conformance refuses it
either way.
validation_time: Option<String>RFC 3339 validation instant. Current UTC time is used when omitted.
stream_presentation_times: Option<Vec<String>>Trusted presentation-assessment instants for stream segments, RFC 3339,
exactly one per supplied segment and in the same order. Entry i is
the instant at which segment i’s C2PA 2.4 session-key validity window
is judged. validation_time still governs certificate and trust-list
evaluation of the init manifest; these instants never move that clock.
The caller vouches for every entry. Supply each from your own trusted
record of when that segment was presented, such as an ingest log or a
packager clock you operate. The verifier never derives them from a
segment’s own signed iat: that self-asserted time remains an
additional check inside the key window and never substitutes for the
caller’s instant. None assesses every segment at validation_time,
which itself defaults to now. A time stamp on the init manifest proves
when the init segment was signed; it does not time stamp later
segments, so a historical archive needs these instants to verify
segments whose keys have since expired.
Sequence continuity is still enforced across the whole supplied run, so
segments signed under different session keys, each valid at its own
instant, verify as one unbroken stream. Applies only to session-key
live streams verified through verify_stream_with_options; a
Merkle-bound or per-segment stream refuses it, as does
verify_fragmented_with_options. Single-asset verification ignores
it. A malformed entry, or a count that differs from the number of
segments supplied, fails the call before any segment is judged.
telemetry: TelemetryOptionsFailure telemetry override. None uses the saved per-user preference.
online: Option<bool>Allow this verification to fetch what the asset references: a manifest
store held elsewhere, certificate revocation status, a did:web
document, externally stored assertion content. None reads the
ENCYPHER_C2PA_ONLINE environment variable and otherwise stays
offline.
A library call never consults the saved per-user choice and never prompts: the caller decides here, or the operator decides through the environment. Whatever is fetched is used as evidence only. The verdict is still reached by the same offline kernel.
online_allow_private_networks: boolIntranet mode: let online checks contact loopback, private, and
link-local addresses, and accept plaintext http for every purpose
rather than for OCSP alone.
Off by default: a file that names an internal host would otherwise turn
this verifier into a probe of the network it runs on. Turn it on for a
deployment whose manifest repository or OCSP responder lives on a
private address, and for tests that serve from 127.0.0.1. Setting it
declares that this machine’s own network is trusted; do not set it on a
host that verifies files sent in by strangers.
Implementations§
Source§impl VerifyOptions
impl VerifyOptions
Sourcepub fn validate(&self) -> Result<(), Error>
pub fn validate(&self) -> Result<(), Error>
Resolve and validate every option without reading or parsing an asset.
Path-based adapters call this before opening asset files so malformed
trust material and invalid validation instants fail deterministically.
The per-segment count of stream_presentation_times needs the segments
and is checked by the stream entry point itself.
Sourcepub fn validate_with_external_data(
&self,
) -> Result<ValidatedExternalData, Error>
pub fn validate_with_external_data( &self, ) -> Result<ValidatedExternalData, Error>
Validate every option and retain decoded external-data evidence.
This has the same error ordering and checks as Self::validate.