faceless2/c2pa

A Java C2PA implementation

c2pa's Issues

Thumbnail assertion created incorrectly

Example to reproduce:

C2PAStore c2pa = new C2PAStore();
C2PAManifest manifest = new C2PAManifest("urn:manifestid");
c2pa.getManifests().add(manifest);
C2PAClaim claim = manifest.getClaim();
claim.setFormat("image/jpeg");
claim.setInstanceID("urn:instanceid");
manifest.getAssertions().add(new C2PA_AssertionHashData());
manifest.getAssertions().add(new C2PA_AssertionThumbnail("image/png", null, new ByteArrayInputStream(new byte[0]), true));

KeyStore keystore = KeyStore.getInstance("PKCS12");
keystore.load(new FileInputStream(KEY_STORE), KEY_STORE_PASSWORD);
PrivateKey key = (PrivateKey) keystore.getKey(KEY_ALIAS, KEY_PASSWORD);
List<X509Certificate> certs = new ArrayList<>();
for (Certificate c : keystore.getCertificateChain(KEY_ALIAS)) {
    certs.add((X509Certificate) c);
}
manifest.getSignature().setSigner(key, certs);
Json j = C2PAHelper.readJPEG(new FileInputStream("unsigned.jpg"));
C2PAHelper.writeJPEG(j, c2pa, new FileOutputStream("signed.jpg"));

// Read back the signed file
j = C2PAHelper.readJPEG(new FileInputStream("signed.jpg"));
c2pa = (C2PAStore)new BoxFactory().load(j.bufferValue("c2pa"));
manifest = c2pa.getActiveManifest();
for (C2PA_Assertion assertion : manifest.getAssertions()) {
    System.out.println(assertion);
}

Expected output:

{"type":"jumb","class":"C2PA_AssertionHashData","size":193}
{"type":"jumb","class":"C2PA_AssertionThumbnail","size":100}

Actual output:

{"type":"jumb","class":"C2PA_AssertionHashData","size":193}
{"type":"jumb","class":"C2PA_AssertionUnknown"}

signed.jpg

I think the issue comes from the label set in the constructor of C2PA_AssertionThumbnail:

c2pa/src/main/com/bfo/box/C2PA_AssertionThumbnail.java

Line 31 in ec951a2

super(SUBTYPE, (claim ? "c2pa.thumbnail.claim." : "c2pa.thumbnail.ingredient.") + mediaSubtype(mediaType), fileName, data);

If I replace SUBTYPE with (claim ? "c2pa.thumbnail.claim." : "c2pa.thumbnail.ingredient.") + mediaSubtype(mediaType), the code seems to work as expected.
However, I'm not 100% sure that this still follows the C2PA spec.