Incorrect support for "other" assertion metadata

[brogdonm]

According to the specification, I believe the CDDL is very restrictive of what the metadata can be:

;Describes additional information about an assertion, including a hashed-uri reference to it. We use a socket/plug here to allow hashed-uri-map to be used in individual files without having the map defined in the same file
$assertion-metadata-map /= {
  ? "dateTime":  tdate, ; The RFC 3339 date-time string when the assertion was created/generated
  ? "reviewRatings": [1* rating-map], ; Ratings given to the assertion (may be empty)
  ? "reference": $hashed-uri-map, ;hashed_uri reference to another assertion that this review is about
  ? "dataSource": source-map, ; A description of the source of the assertion data, selected from a predefined list
  ? "localizations" : [1* localization-data-entry] ; localizations for strings in the assertion
  ? "regionOfInterest" : $region-map ; describes a region of the asset where this assertion is relevant
}

But the SDK currently allows for other metadata:

• c2pa-rs/sdk/src/assertions/metadata.rs

  Line 47 in c72f746

  other: HashMap<String, Value>,

I believe this to be erroneous and can lead to invalid content credentials.

[brogdonm]

I have a branch with it removed if this is something you all agree with.

[ok-nick]

It looks like this field was removed from version 2.0 to 2.1 of the spec. We still want the ability to read this field for backwards compatibility, but we may not want to write it.

2.0: https://spec.c2pa.org/specifications/specifications/2.0/specs/C2PA_Specification.html#_metadata_about_assertions
2.1: https://spec.c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html#_metadata_about_assertions

[ok-nick]

I'm going to close this issue in favor of #1248, there is some work we need to do on our assertions.

[brogdonm]

It looks like this field was removed from version 2.0 to 2.1 of the spec. We still want the ability to read this field for backwards compatibility, but we may not want to write it.

2.0: https://spec.c2pa.org/specifications/specifications/2.0/specs/C2PA_Specification.html#_metadata_about_assertions 2.1: https://spec.c2pa.org/specifications/specifications/2.1/specs/C2PA_Specification.html#_metadata_about_assertions

True, although, if I remember correctly assertion-metadata-map-extension was never really defined in the specification and therefore it was erroneous from the start?

For that reason, @ok-nick I do think it should just be removed, and the issue stands on its own.

[ok-nick]

Good catch, I'll reopen this issue. Feel free to send a PR and we can take a look.