Skip to content

v0.2.0 — full pure-Go C2PA validation

Choose a tag to compare

View all tags
@richardwooding richardwooding released this 11 Jun 08:00
· 16 commits to main since this release
v0.2.0
133d45f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First release with cryptographic validation. The library is now a two-mode pure-Go (no cgo) C2PA / Content Credentials toolkit for JPEG & PNG.

Added — Validate

A full, opt-in verifier alongside the existing fast, unverified Read:

r := c2pa.Validate(ctx, c2pa.JPEG, reader, opts...)
// r.Valid, r.Statuses (C2PA §15 codes), r.SignerChain, r.SignedAt, r.Info

It performs the complete C2PA validation algorithm in pure Go:

  • COSE signature — detached-payload COSE_Sign1 verification (ES256/384/512, PS256/384/512, EdDSA).
  • Certificate chain + C2PA profile — chains the signer to the trust list and enforces the C2PA cert profile (EKU, key usage, no weak algorithms), pinned to the verified signing time.
  • Hash bindings — c2pa.hash.data (asset content hash, with exclusions) and per-assertion hashed_uri integrity.
  • RFC 3161 timestamp — full CMS signature verification, TSA chain, and message-imprint binding to the signature.
  • Revocation — OCSP/CRL, opt-in (WithOnlineRevocation), soft-fail.
  • Ingredients — recursive nested-manifest validation with depth cap and cycle detection.

Trust anchors are the official C2PA conformance lists, embedded via go:embed and overridable with WithSigningTrust / WithTimestampTrust. Options: WithOnlineRevocation, WithClock, WithMaxIngredientDepth, WithMaxScan, WithHTTPClient.

Read is unchanged — same fast, never-fail, unverified behaviour.

Changed

  • Go 1.25+ is now required (the floor is set by golang.org/x/crypto, pulled in for OCSP).
  • New dependency: golang.org/x/crypto. Still no cgo.

Full changelog: v0.1.0...v0.2.0

Assets 2
Loading