C2PA Node.js library

The c2pa-node-v2 repository implements a Node.js API that can:

• Read and validate C2PA data from media files in supported formats.
• Add signed manifests to media files in supported formats.

WARNING: This is an early version of this library, and there may be bugs and unimplemented features.

Prerequisites

To use the C2PA Node library, you must install:

• A supported version of Node.
• Rust.

If you need to manage multiple versions of Node on your machine, use a tool such as nvm.

Installation

Installing for use in an app

Using npm:

$ npm install @contentauth/c2pa-node

Using Yarn:

$ yarn add @contentauth/c2pa-node

Using pnpm:

$ pnpm add @contentauth/c2pa-node

This command will download precompiled binaries for the following systems:

• Linux x86_64
• Linux aarch64 (ARM)
• macOS aarch64 (Apple Silicon)
• macOS x86_64 (Intel Mac)
• Windows x86
• Windows ARM

Components

Reader

The Reader class is used to read and validate C2PA manifests from media files. It can parse embedded manifests or fetch remote manifests.

import { Reader } from '@contentauth/c2pa-node';

// Read from an asset file
const reader = await Reader.fromAsset(inputAsset);

// Read from manifest data and asset
const reader = await Reader.fromManifestDataAndAsset(manifestData, asset);

// Get the manifest store as JSON
const manifestStore = reader.json();

// Get the active manifest
const activeManifest = reader.getActive();

// Check if manifest is embedded
const isEmbedded = reader.isEmbedded();

// Get remote URL if applicable
const remoteUrl = reader.remoteUrl();

Builder

The Builder class is the main component for creating and signing C2PA manifests. It provides methods to add assertions, resources, and ingredients to manifests, and handles the signing process. Use the Signer class to sign the manifests.

import { Builder } from '@contentauth/c2pa-node';

// Create a new builder
const builder = Builder.new();

// Or create from an existing manifest definition
const builder = Builder.withJson(manifestDefinition);

// Add assertions to the manifest
builder.addAssertion('c2pa.actions', actionsAssertion);

// Add resources
await builder.addResource('resource://example', resourceAsset);

// Sign the manifest
const manifest = builder.sign(signer, inputAsset, outputAsset);

Signers

The library provides several types of signers for different use cases:

LocalSigner

For local signing with certificates and private keys:

import { LocalSigner } from '@contentauth/c2pa-node';

// Create a local signer with certificate and private key
const signer = LocalSigner.newSigner(
  certificateBuffer,
  privateKeyBuffer,
  'es256', // signing algorithm
  'https://timestamp.example.com' // optional TSA URL
);

// Sign data
const signature = signer.sign(dataBuffer);

CallbackSigner

For custom signing implementations using callbacks:

import { CallbackSigner } from '@contentauth/c2pa-node';

// Create a callback signer
const signer = CallbackSigner.newSigner(
  {
    alg: 'es256',
    certs: [certificateBuffer],
    reserveSize: 1024, // Reserved size in bytes for the C2PA Claim Signature box.
    tsaUrl: 'https://timestamp.example.com'
  },
  async (data) => {
    // Custom signing logic
    return await customSigningFunction(data);
  }
);

Identity Assertion Components

For working with identity assertions and CAWG (Content Authenticity Working Group) identities:

IdentityAssertionBuilder

Builds identity assertions with roles and referenced assertions:

import { IdentityAssertionBuilder, CallbackCredentialHolder } from '@contentauth/c2pa-node';

// Create a credential holder
const credentialHolder = CallbackCredentialHolder.newCallbackCredentialHolder(
  1024,     // reserveSize
  'es256',  // sigType
  async (payload) => {
    // Custom signing logic for identity assertions
    return await signIdentityPayload(payload);
  }
);

// Create an identity assertion builder
const identityBuilder = await IdentityAssertionBuilder.identityBuilderForCredentialHolder(
  credentialHolder
);

// Add roles and referenced assertions
identityBuilder.addRoles(['photographer', 'editor']);
identityBuilder.addReferencedAssertions(['c2pa.actions']);

IdentityAssertionSigner

Signs manifests with identity assertions:

import { IdentityAssertionSigner } from '@contentauth/c2pa-node';

// Create an identity assertion signer
const identitySigner = IdentityAssertionSigner.new(callbackSigner);

// Add identity assertion
identitySigner.addIdentityAssertion(identityBuilder);

// Use with Builder for signing
const manifest = await builder.signAsync(identitySigner, inputAsset, outputAsset);

Trustmark

The Trustmark class provides functionality for encoding and decoding trustmarks in images:

import { Trustmark } from '@contentauth/c2pa-node';

// Create a trustmark instance
const trustmark = await Trustmark.newTrustmark({
  // trustmark configuration
});

// Encode a trustmark into an image
const encodedImage = await trustmark.encode(
  imageBuffer,
  0.5, // strength
  'watermark-text' // optional watermark
);

// Decode a trustmark from an image
const decodedData = await trustmark.decode(imageBuffer);

Settings and Configuration

The library provides comprehensive settings management for trust configuration, verification settings, and global C2PA settings:

import {
  loadC2paSettings,
  loadTrustConfig,
  loadVerifyConfig,
  loadSettingsFromFile,
  loadSettingsFromUrl
} from '@contentauth/c2pa-node';

// Load settings from JSON string
loadC2paSettings('{"trust": {"verify_trust_list": true}}');

// Load settings from file
await loadSettingsFromFile('./c2pa-settings.json');

// Load settings from URL
await loadSettingsFromUrl('https://example.com/c2pa-settings.json');

// Configure trust settings
loadTrustConfig({
  verifyTrustList: true,
  userAnchors: ['anchor1', 'anchor2'],
  trustAnchors: ['trust-anchor1'],
  allowedList: ['allowed-cert1']
});

// Configure verification settings
loadVerifyConfig({
  verifyAfterReading: true,
  verifyAfterSign: true,
  verifyTrust: true,
  ocspFetch: true,
  remoteManifestFetch: true
});