v0.1.0

First tagged release of ext-c2pa — PHP-native C2PA Content Credentials, built in Rust on the official c2pa crate via ext-php-rs. PHP namespace: Automattic\VIP\C2PA.

Documentation: c2pa.eamann.com

Highlights

• Read & validate — Reader::fromBytes() verdicts (Valid / Invalid / Trusted / no-manifest), full manifest-store JSON, and a compact UI-oriented summary() (signer, claim generator, actions, ingredients, AI-generated detection).
• Sign — Builder::create() embeds a signed manifest into a new original (IPTC DigitalSourceType intent, custom assertions, custom claim-generator name).
• Derivative provenance chains — Builder::edit() re-signs a derivative as an edit carrying its parent as a parentOf ingredient, so every generated size of an image keeps a verifiable chain back to the original. Cross-validated against c2patool.
• Trust configuration — Settings::withTrustAnchors() PEM anchor bundles distinguish cryptographically sound from chained to a trusted signer. No implicit trust list.
• Signing identities — bring-your-own-key (Signer::fromPem(), ES/PS/EdDSA algorithms), or mint a per-site CA + leaf meeting the C2PA certificate profile with Signer::generateSelfSigned($org).
• In-memory, no I/O — bytes in, bytes out. Compiled without filesystem access, remote-manifest fetching, or timestamp-authority calls; pure-Rust crypto (no OpenSSL linkage).

Install

Pre-built binaries below follow PIE's naming convention for PHP 8.3 / 8.4 / 8.5 (NTS) on macos-arm64, linux-x86_64, and linux-arm64:

pie install ericmann/ext-c2pa

Or manually: grab the tarball matching your platform/PHP, verify the .sha256 sidecar, and point php.ini at the extracted c2pa.so. Building from source needs Rust and php-config — see the installation docs.

Known caveats

• Signer::selfSigned() is a development credential compiled into the binary — never a real signatory.
• ZTS is declared supported but not exercised in CI; Windows and musl are not shipped.
• THIRD-PARTY-LICENSES.html (attached) is the cargo about manifest of everything statically linked into these binaries.

License: GPL-2.0-or-later © Automattic, Inc.