From 4e2401525ec67ce076ff9198d0332eba43ded5e9 Mon Sep 17 00:00:00 2001 From: Rand McKinney Date: Fri, 7 Aug 2026 11:30:01 -0700 Subject: [PATCH] Remove ununsed deprecated c2pa dependency --- docs/conformance/cert-checks.mdx.txt | 120 --------------------------- package.json | 1 - pnpm-lock.yaml | 3 - 3 files changed, 124 deletions(-) delete mode 100644 docs/conformance/cert-checks.mdx.txt diff --git a/docs/conformance/cert-checks.mdx.txt b/docs/conformance/cert-checks.mdx.txt deleted file mode 100644 index 836d975e..00000000 --- a/docs/conformance/cert-checks.mdx.txt +++ /dev/null @@ -1,120 +0,0 @@ ---- -id: cert-checks -title: Cert checks (saved) ---- - -## Checking your certificate - -Before requesting to [add your signing certificate to the interim known certificate list](#how-to-add-a-certificate-to-the-list), perform a preliminary check to ensure the certificate is configured properly. - -### Prerequisites - -The preliminary certificate check procedure below requires the following tools. You must install them if you haven't done so already: - -- [jq](https://jqlang.org/), a lightweight and flexible command-line JSON processor. On macOS, if you have [Homebrew](https://brew.sh/), you can install jq by entering `brew install jq`. -- [OpenSSL](https://www.openssl.org/), a cryptographic software library and CLI. It's installed on many systems such as macOS (but make sure you have a recent version). If OpenSSL is not installed on your system, see the [list of unofficial binary distributions](https://wiki.openssl.org/index.php/Binaries). -- [C2PA Tool](c2patool/readme.md), the command line tool for working with C2PA manifests and media assets. - -### Procedure - -:::note -In the example commands given below, `cert.pem` is your certificate file. -::: - -Check your certificate by following these steps: - -1. **Ensure that signing with the certificate doesn't have any validation errors** by using a C2PA Tool command like this: - - ``` - c2patool ./image.jpg trust --allowed_list ./cert.pem - ``` - - Confirm that the result does not contain a `validation_status` field, which indicates an error. - -1. **Confirm that the `signature_info.issuer` field in the manifest is correct**. This field determines what [Verify displays for the organization name](verify.mdx#title-and-signing-information) after "Issued by ...". Use a C2PA Tool command like this: - - ``` - c2patool ./image.jpg trust --allowed_list ./cert.pem \ - | jq --args '.manifests[].signature_info.issuer' - ``` - - The response should be something like this: - - ``` - "XYZ Inc." - ``` - - Where "XYZ Inc." is the name of your organization. - -1. **Use `openssl` to perform basic verification of the certificate** you're submitting; for example: - - ``` - openssl x509 -noout -text -in 'cert.pem' | grep 'Subject:' - ``` - - Example response: - - ``` - Subject: organizationIdentifier=XYZ-7155227, C=US, ST=Delaware, L=Dover, O=Whatever Inc., SN=xxx, GN=xxx, CN=xxx - ``` - -## Using the interim known certificate list - -You can use the C2PA Tool or the CAI JavaScript library to determine whether a certificate is on the interim known certificate list. - -### Using with C2PA Tool - -The [C2PA Tool documentation](c2patool/docs/usage.md#configuring-trust-support) explains how to use the interim known certificate list with the tool. - -### Using with the JavaScript library - -To load and use these lists with the JavaScript library (`c2pa-js`), pass them to the `read` function as shown in the following TypeScript example: - -```ts -import { createC2pa, type ToolkitSettings } from 'c2pa'; -import wasmSrc from 'c2pa/dist/assets/wasm/toolkit_bg.wasm?url'; -import workerSrc from 'c2pa/dist/c2pa.worker.min.js?url'; - -async function loadTrustResource(file: string): Promise { - const res = await fetch(`https://contentcredentials.org/trust/${file}`); - - return res.text(); -} - -async function getToolkitSettings(): Promise { - const [trustAnchors, allowedList, trustConfig] = await Promise.all( - ['anchors.pem', 'allowed.sha256.txt', 'store.cfg'].map(loadTrustResource), - ); - - return { - trust: { - trustConfig, - trustAnchors, - allowedList, - }, - verify: { - verifyTrust: true, - }, - }; -} - -async function readFile(asset: File) { - const c2pa = await createC2pa({ - wasmSrc, - workerSrc, - }); - - return c2pa.read(asset, { - settings: await getToolkitSettings(), - }); -} -``` - -:::note -This code is for illustration purposes only. To ensure acceptable performance, production code should reuse the `c2pa` object and cache the output of `getToolkitSettings()` to avoid making unnecessary network calls. -::: - -Follow these steps: - -1. [**Do a preliminary check of your certificate**](#checking-your-certificate) to ensure it meets the requirements for C2PA signing certificates and to be in the Verify interim certificate list. -1. **Submit your request** by .... diff --git a/package.json b/package.json index 7f2b5ad6..724fe10d 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,6 @@ "@mdx-js/react": "^3.0.0", "@signalwire/docusaurus-plugin-llms-txt": "^1.2.2", "@stackblitz/sdk": "^1.6.0", - "c2pa": "^0.30.17", "c2pa-wc": "^0.14.17", "clsx": "^1.1.1", "docusaurus-json-schema-plugin": "^1.6.1", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4f4e2ebc..dc2a2c6b 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -32,9 +32,6 @@ dependencies: '@stackblitz/sdk': specifier: ^1.6.0 version: 1.11.0 - c2pa: - specifier: ^0.30.17 - version: 0.30.17 c2pa-wc: specifier: ^0.14.17 version: 0.14.17