C2PA metadata handling #662
Conversation
There was a problem hiding this comment.
Thank you a bunch for the PR!
I do question how open a standard truly is if, in practice, implementers end up hardcoding yet another centralized trust list curated by Adobe, especially when considering that a explicit design goal of the C2PA spec is "Whole Workflow Applicability". To be fair, the C2PA Implementation Guide mentions DLTs and NFTs as solutions to that problem, but I don't see them being relevant in practical applications. That said, this definitely is a topic better suited for discussion elsewhere, not on a technically good PR review 😂
I also like how you refactored the main function to return an ExitCode instead of calling exit, which plays nicer with destructors.
I just have a small nitpick before we can merge this.
| @@ -75,6 +75,8 @@ pub struct Chunk { | |||
| #[derive(Debug, PartialEq, Eq, Clone)] | |||
| pub enum StripChunks { | |||
| /// None | |||
| /// | |||
| /// …except caBX chunk if it contains a C2PA.org signature. | |||
There was a problem hiding this comment.
Could you replace this Unicode ellipsis character with three separate ASCII dots? It may be uncommon these days, but I can foresee some reasonable font and editor combinations having trouble to display it correctly.
There's Adobe's initiative to embed "provenance" metadata in files along with a cryptographically signed history of file changes. The metadata is invalidated if the file is changed in any way without updating the signature. Only parties trusted by Adobe are allowed to sign files.
AFAIK an open-source program can't be given a private key to sign its changes, so
oxipng's only choices are to either avoid changing the signed files at all, or strip the invalidated c2pa metadata when optimizing files.I've made
oxipngstrip the c2pa metadata by default. If explicit--keep=caBXis used, then the file will be skipped with a warning "The image contains C2PA manifest that would be invalidated by any file changes".