Skip to content

fix: change timestamp validation to return new required info fields #1191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Jul 9, 2025
Merged

fix: change timestamp validation to return new required info fields #1191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
5c20b6c
Fix timestamp validation to match spec
mauricefisher64 Jun 25, 2025
e53b243
restore old alg writing for Claims
mauricefisher64 Jun 25, 2025
f544893
Dump name of the cert that was verified
mauricefisher64 Jun 26, 2025
05408d7
Minor fix to retrieving timestamps
mauricefisher64 Jun 26, 2025
bc82111
Switch to RASN for decode SignedData constructs to avoid other crate …
mauricefisher64 Jul 8, 2025
a24befb
Fix build issue
mauricefisher64 Jul 8, 2025
bdf3351
fix message strings
mauricefisher64 Jul 8, 2025
5e06b8e
Merge branch 'main' of https://github.com/contentauth/c2pa-rs into cr…
mauricefisher64 Jul 8, 2025
115a02a
Clippy fix
mauricefisher64 Jul 8, 2025
cd60971
Remove unused code
mauricefisher64 Jul 8, 2025
03c2233
Report full paths
mauricefisher64 Jul 8, 2025
8ae5bfe
Support validating OCSP with alternate timestamp
mauricefisher64 Jul 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 28 additions & 33 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 4 additions & 3 deletions sdk/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,9 +151,10 @@ quick-xml = "0.37.1"
rand = "0.8.5"
rand_chacha = "0.3.1"
range-set = "0.0.11"
rasn = "0.22.0"
rasn-ocsp = "0.22.0"
rasn-pkix = "0.22.0"
rasn = "0.26.0"
rasn-cms = "0.26.0"
rasn-ocsp = "0.26.0"
rasn-pkix = "0.26.0"
regex = "1.11"
riff = "2.0.0"
rsa = { version = "0.9.7", features = ["pem", "sha2", "std"], optional = true }
Expand Down
2 changes: 1 addition & 1 deletion sdk/src/builder.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1523,7 +1523,7 @@ mod tests {
"sample1.heic",
"sample1.heif",
"sample1.m4a",
"video1.mp4",
"video1_no_manifest.mp4",
"cloud_manifest.c2pa", // we need a new test for this since it will always fail
];
for file_name in TESTFILES {
Expand Down
60 changes: 44 additions & 16 deletions sdk/src/claim.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
cbor_types::{map_cbor_to_type, value_cbor_to_type},
cose_validator::{get_signing_info, get_signing_info_async, verify_cose, verify_cose_async},
crypto::{
asn1::rfc3161::TstInfo,
base64,
cose::{parse_cose_sign1, CertificateInfo, CertificateTrustPolicy, OcspFetchPolicy},
ocsp::OcspResponse,
Expand All @@ -53,8 +54,8 @@
},
labels::{
assertion_label_from_uri, box_name_from_uri, manifest_label_from_uri,
manifest_label_to_parts, to_absolute_uri, to_assertion_uri, to_databox_uri, ASSERTIONS,
CLAIM, CREDENTIALS, DATABOX, DATABOXES, SIGNATURE,
manifest_label_to_parts, to_absolute_uri, to_assertion_uri, to_databox_uri,
to_signature_uri, ASSERTIONS, CLAIM, CREDENTIALS, DATABOX, DATABOXES, SIGNATURE,
},
},
jumbf_io::get_assetio_handler,
Expand Down Expand Up @@ -1060,6 +1061,11 @@
}
}

/// true algorithm
pub fn alg_raw(&self) -> Option<&str> {
self.alg.as_deref()
}

/// get soft algorithm
pub fn alg_soft(&self) -> Option<&String> {
self.alg_soft.as_ref()
Expand Down Expand Up @@ -1786,7 +1792,7 @@
let data = claim.data()?;

// use the signature uri as the current uri while validating the signature info
validation_log.push_current_uri(claim.signature.clone());
validation_log.push_current_uri(to_signature_uri(claim.label()));

// make sure signature manifest if present points to this manifest
let sig_box_err = match jumbf::labels::manifest_label_from_uri(&claim.signature) {
Expand All @@ -1799,7 +1805,7 @@

if sig_box_err {
log_item!(
claim.signature_uri(),
to_signature_uri(claim.label()),

Check warning on line 1808 in sdk/src/claim.rs

View check run for this annotation

Codecov / codecov/patch

sdk/src/claim.rs#L1808 

Added line #L1808 was not covered by tests
"signature missing",
"verify_claim_async"
)
Expand All @@ -1810,15 +1816,21 @@
let sign1 = parse_cose_sign1(&sig, &data, validation_log)?;

// check certificate revocation
check_ocsp_status(&sign1, &data, ctp, validation_log)?;
check_ocsp_status(
&sign1,
&data,
ctp,
svi.timestamps.get(claim.label()),
validation_log,
)?;

let verified = verify_cose_async(
&sig,
&data,
&additional_bytes,
cert_check,
ctp,
svi.timestamps.get(claim.label()).cloned(),
svi.timestamps.get(claim.label()),
validation_log,
)
.await;
Expand All @@ -1844,7 +1856,7 @@
let additional_bytes: Vec<u8> = Vec::new();

// use the signature uri as the current uri while validating the signature info
validation_log.push_current_uri(claim.signature.clone());
validation_log.push_current_uri(to_signature_uri(claim.label()));

// make sure signature manifest if present points to this manifest
let sig_box_err = match jumbf::labels::manifest_label_from_uri(&claim.signature) {
Expand All @@ -1856,9 +1868,13 @@
};

if sig_box_err {
log_item!(claim.signature_uri(), "signature missing", "verify_claim")
.validation_status(validation_status::CLAIM_SIGNATURE_MISSING)
.failure(validation_log, Error::ClaimMissingSignatureBox)?;
log_item!(
to_signature_uri(claim.label()),
"signature missing",
"verify_claim"
)
.validation_status(validation_status::CLAIM_SIGNATURE_MISSING)
.failure(validation_log, Error::ClaimMissingSignatureBox)?;

Check warning on line 1877 in sdk/src/claim.rs

View check run for this annotation

Codecov / codecov/patch

sdk/src/claim.rs#L1871-L1877 

Added lines #L1871 - L1877 were not covered by tests
}

let data = if let Some(ref original_bytes) = claim.original_bytes {
Expand All @@ -1870,15 +1886,21 @@
let sign1 = parse_cose_sign1(sig, data, validation_log)?;

// check certificate revocation
check_ocsp_status(&sign1, data, ctp, validation_log)?;
check_ocsp_status(
&sign1,
data,
ctp,
svi.timestamps.get(claim.label()),
validation_log,
)?;

let verified = verify_cose(
sig,
data,
&additional_bytes,
cert_check,
ctp,
svi.timestamps.get(claim.label()).cloned(),
svi.timestamps.get(claim.label()),
validation_log,
);

Expand Down Expand Up @@ -1941,6 +1963,9 @@
validation_log,
Error::ValidationRule("No Action array in Actions".into()),
)?;

// failure full stop
return Err(Error::ValidationRule("No Action array in Actions".into()));

Check warning on line 1968 in sdk/src/claim.rs

View check run for this annotation

Codecov / codecov/patch

sdk/src/claim.rs#L1968 

Added line #L1968 was not covered by tests
}

// check Claim.v2 first action rules
Expand Down Expand Up @@ -2596,7 +2621,7 @@
Ok(vi) => {
if !vi.validated {
log_item!(
claim.signature_uri(),
to_signature_uri(claim.label()),

Check warning on line 2624 in sdk/src/claim.rs

View check run for this annotation

Codecov / codecov/patch

sdk/src/claim.rs#L2624 

Added line #L2624 was not covered by tests
"claim signature is not valid",
"verify_internal"
)
Expand All @@ -2605,7 +2630,7 @@
} else {
// signing cert has not expired
log_item!(
claim.signature_uri(),
to_signature_uri(claim.label()),
"claim signature valid",
"verify_internal"
)
Expand All @@ -2614,7 +2639,7 @@

// add signature validated status
log_item!(
claim.signature_uri(),
to_signature_uri(claim.label()),
"claim signature valid",
"verify_internal"
)
Expand All @@ -2625,7 +2650,7 @@
Err(parse_err) => {
// handle case where lower level failed to log
log_item!(
claim.signature_uri(),
to_signature_uri(claim.label()),
"claim signature is not valid",
"verify_internal"
)
Expand Down Expand Up @@ -3792,6 +3817,7 @@
sign1: &coset::CoseSign1,
data: &[u8],
ctp: &CertificateTrustPolicy,
tst_info: Option<&TstInfo>,
validation_log: &mut StatusTracker,
) -> Result<OcspResponse> {
// Moved here instead of c2pa-crypto because of the dependency on settings.
Expand All @@ -3807,6 +3833,7 @@
data,
fetch_policy,
ctp,
tst_info,
validation_log,
)?)
} else {
Expand All @@ -3815,6 +3842,7 @@
data,
fetch_policy,
ctp,
tst_info,

Check warning on line 3845 in sdk/src/claim.rs

View check run for this annotation

Codecov / codecov/patch

sdk/src/claim.rs#L3845 

Added line #L3845 was not covered by tests
validation_log,
)
.await?)
Expand Down
Loading
Loading