Skip to content

v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 02:50
v0.1.0
This tag was signed with the committer’s verified signature.
ericmann Eric Mann
SSH Key Fingerprint: bI2Sr+FYrVtGZkzTO39bIh5ugSl8PKe1qi6GWcjUGKE
Verified
Learn about vigilant mode.
eeea432
This commit was signed with the committer’s verified signature.
ericmann Eric Mann
SSH Key Fingerprint: bI2Sr+FYrVtGZkzTO39bIh5ugSl8PKe1qi6GWcjUGKE
Verified
Learn about vigilant mode.

First tagged release of ext-c2pa — PHP-native C2PA Content Credentials, built in Rust on the official c2pa crate via ext-php-rs. PHP namespace: Automattic\VIP\C2PA.

Documentation: c2pa.eamann.com

Highlights

  • Read & validate — Reader::fromBytes() verdicts (Valid / Invalid / Trusted / no-manifest), full manifest-store JSON, and a compact UI-oriented summary() (signer, claim generator, actions, ingredients, AI-generated detection).
  • Sign — Builder::create() embeds a signed manifest into a new original (IPTC DigitalSourceType intent, custom assertions, custom claim-generator name).
  • Derivative provenance chains — Builder::edit() re-signs a derivative as an edit carrying its parent as a parentOf ingredient, so every generated size of an image keeps a verifiable chain back to the original. Cross-validated against c2patool.
  • Trust configuration — Settings::withTrustAnchors() PEM anchor bundles distinguish cryptographically sound from chained to a trusted signer. No implicit trust list.
  • Signing identities — bring-your-own-key (Signer::fromPem(), ES/PS/EdDSA algorithms), or mint a per-site CA + leaf meeting the C2PA certificate profile with Signer::generateSelfSigned($org).
  • In-memory, no I/O — bytes in, bytes out. Compiled without filesystem access, remote-manifest fetching, or timestamp-authority calls; pure-Rust crypto (no OpenSSL linkage).

Install

Pre-built binaries below follow PIE's naming convention for PHP 8.3 / 8.4 / 8.5 (NTS) on macos-arm64, linux-x86_64, and linux-arm64:

pie install ericmann/ext-c2pa

Or manually: grab the tarball matching your platform/PHP, verify the .sha256 sidecar, and point php.ini at the extracted c2pa.so. Building from source needs Rust and php-config — see the installation docs.

Known caveats

  • Signer::selfSigned() is a development credential compiled into the binary — never a real signatory.
  • ZTS is declared supported but not exercised in CI; Windows and musl are not shipped.
  • THIRD-PARTY-LICENSES.html (attached) is the cargo about manifest of everything statically linked into these binaries.

License: GPL-2.0-or-later © Automattic, Inc.

Assets 21
Loading