C2PA and PNG

[svgeesus]

Coalition for Content Provenance and Authenticity (C2PA) develops technical specifications that can establish content provenance and authenticity at scale.

It is proposed to add an (already deployed) chunk for C2PA, caBX, to the PNG specification.

Useful links:

• INTRODUCTION TO CONTENT CREDENTIALS by LEONARD ROSENTHOL (PDF)
• Presentations from IPTC Photo Metadata Conference 2025

[svgeesus]

There is a GitHub repository of example C2PA files but currently, the PNG directory is empty

• Add additional image file formats c2pa-org/public-testfiles#14

[svgeesus]

Well, getting somewhere

chris@SuperNomad:~/PNG/C2PA$ pngcheck -v signed_image.png
File: signed_image.png (328761 bytes)
  chunk IHDR at offset 0x0000c, length 13
    1024 x 683 image, 24-bit RGB, non-interlaced
  chunk caBX at offset 0x00025, length 59626
    unknown private, ancillary, unsafe-to-copy chunk
  chunk pHYs at offset 0x0e91b, length 9: 9449x9449 pixels/meter (240 dpi)
  chunk IDAT at offset 0x0e930, length 269045
    zlib: deflated, 512-byte window, superfast compression
  chunk IEND at offset 0x50431, length 0
No errors detected in signed_image.png (5 chunks, 84.3% compression).

and

.\c2patool .\signed_image.png
{
  "active_manifest": "urn:uuid:600cd897-657c-4fcc-876b-27522523db82",
  "manifests": {
    "urn:uuid:600cd897-657c-4fcc-876b-27522523db82": {
      "claim_generator": "testapp/1.0.0",
      "claim_generator_info": [
        {
          "name": "TestApp",
          "version": "1.0.0",
          "org.contentauth.c2pa_rs": "0.65.0"
        }
      ],
      "title": "My Title",
      "format": "image/png",
      "instance_id": "xmp:iid:f51a878c-12f9-4bbc-b3b2-65ceabbdc601",
      "thumbnail": {
        "format": "image/jpeg",
        "identifier": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.assertions/c2pa.thumbnail.claim.jpeg"
      },
      "ingredients": [],
      "assertions": [
        {
          "label": "c2pa.actions.v2",
          "data": {
            "actions": [
              {
                "action": "c2pa.opened"
              }
            ],
            "allActionsIncluded": true,
            "metadata": {
              "reviewRatings": [
                {
                  "explanation": "Something untracked happened",
                  "code": "c2pa.unknown",
                  "value": 4
                }
              ]
            }
          }
        },
        {
          "label": "my.assertion",
          "data": {
            "any_tag": "whatever I want"
          }
        }
      ],
      "signature_info": {
        "alg": "Es256",
        "issuer": "C2PA Test Signing Cert",
        "common_name": "C2PA Signer",
        "cert_serial_number": "640229841392226413189608867977836244731148734950",
        "time": "2025-09-22T15:08:07+00:00"
      },
      "label": "urn:uuid:600cd897-657c-4fcc-876b-27522523db82"
    }
  },
  "validation_results": {
    "activeManifest": {
      "success": [
        {
          "code": "timeStamp.validated",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.signature",
          "explanation": "timestamp message digest matched: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1"
        },
        {
          "code": "claimSignature.insideValidity",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.signature",
          "explanation": "claim signature valid"
        },
        {
          "code": "claimSignature.validated",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.signature",
          "explanation": "claim signature valid"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.assertions/c2pa.thumbnail.claim.jpeg",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.assertions/c2pa.actions.v2",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions.v2"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.assertions/my.assertion",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/my.assertion"
        },
        {
          "code": "assertion.hashedURI.match",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.assertions/c2pa.hash.data",
          "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data"
        },
        {
          "code": "assertion.dataHash.match",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.assertions/c2pa.hash.data",
          "explanation": "data hash valid"
        }
      ],
      "informational": [
        {
          "code": "timeStamp.untrusted",
          "url": "self#jumbf=/c2pa/urn:uuid:600cd897-657c-4fcc-876b-27522523db82/c2pa.signature",
          "explanation": "timestamp cert untrusted: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1"
        }
      ],
      "failure": []
    }
  },
  "validation_state": "Valid"

[svgeesus]

I see a website called C2PA Studio, described as

Easily manage C2PA metadata in your images. Add or remove specific chunks to control content provenance information.

It mainly seems to remove such metadta, and says there are four such chunks:

C2PA chunks that will be removed:
caBX C2PA C2CI C2CS
These are the standard chunks used for C2PA content provenance metadata

Another page on that site defines what they are for:

• caBX: Content Authenticity Binary eXtension - Contains C2PA manifest data
• C2PA: Main C2PA data chunk
• C2CI: C2PA Content Information
• C2CS: C2PA Content Signature

[svgeesus]

The tool I was using to inspect caBX chunks is c2patool:

https://github.com/contentauth/c2pa-rs/tree/main/cli

[svgeesus]

Resolved at the 29 September 2025 meeting to add caBX (including with the private bit set). There are millions of existing PNG with this chunk.

In consequence, resolved also to mark the public/private bit as historical Just like other naming schemes (x- MIME types, CSS vendor prefixes, etc) this mechanism did not in practice solve the issue it was designed for, and ended up adding confusion and resulting in 'private' and temporary identifiers becoming part of official standards.