# Credentio

C++ libraries to support validation and generation of C2PA Content Credentials
(https://c2pa.org/).

NOTE: We are actively developing this project and may introduce breaking changes
without notice.

## Supported Media Formats

The library supports C2PA provenance extraction and validation for files with
the following extensions:

<!-- mdformat off(no multiline table cells) -->

Category        | Extensions
:-------------- | :---------
**Image**       | `.avif`, `.dng`, `.gif`, `.heic`, `.heif`, `.jpeg`, `.jpg`, `.png`, `.tif`, `.tiff`, `.webp`
**Video/Audio** | `.avi`, `.m4a`, `.mov`, `.mp3`, `.mp4`, `.wav`, `.flac`
**Document**    | `.pdf`, `.docx`, `.pptx`, `.xlsx`

<!-- mdformat on -->

## Prerequisites

*   Clang
*   Bazel
*   Git

## Dependencies

*   [Abseil (`abseil-cpp`)](https://abseil.io/)
*   [Riegeli](https://github.com/google/riegeli)
*   [BoringSSL](https://github.com/google/boringssl)
*   [GoogleTest (`googletest`)](https://github.com/google/googletest)
*   [Google Tink (`tink_cc`)](https://github.com/tink-crypto/tink-cc)
*   [LibCppBor](https://android.googlesource.com/platform/system/libcppbor/)
*   [nlohmann_json](https://github.com/nlohmann/json)
*   [Protocol Buffers (`protobuf`)](https://github.com/protocolbuffers/protobuf)

## Quickstart

Credentio includes a fast standalone command-line tool for inspecting and
verifying C2PA metadata embedded in media assets.

#### Building the CLI

```bash
bazel build tools:c2pa_validate
```

#### Validating with Trust Anchors

You can validate assets against specific PEM-encoded trust anchors for claim
signers and Time Stamping Authorities (TSA):

```bash
bazel run tools:c2pa_validate -- \
  --asset=/path/to/asset.jpg \
  --claim_signer_trust=/path/to/claim_signer_trust_anchors.pem \
  --tsa_trust=/path/to/tsa_trust_anchors.pem
```

> **Note on Trust Lists:** Credentio does not distribute or provide trust anchor
> lists. You can obtain the latest official C2PA trust lists from the C2PA
> organization on GitHub
> ([https://github.com/c2pa-org/conformance-public/tree/main/trust-list](https://github.com/c2pa-org/conformance-public/tree/main/trust-list)).

## Building & Testing

To build the entire project:

```bash
bazel build ...
```

To execute all unit tests:

```bash
bazel test ...
```

## Support & Releases

Credentio recommends that users **live-at-head** (updating to the latest commit
on the main branch as often as possible). We are actively developing this
project and may introduce breaking changes without notice.

## License & Disclaimer

Credentio is licensed under the terms of the Apache 2.0 License. See
[LICENSE](LICENSE) for more information.

### Disclaimer

This is not an officially supported Google product. This project is not eligible
for the
[Google Open Source Software Vulnerability Rewards Program](https://bughunters.google.com/open-source-security).

## Contact

For questions, feedback, or inquiries, please contact:
`credentio-team@google.com`.