C2PA Python library
The c2pa-python repository provides a Python library that can:
- Read and validate C2PA manifest data from media files in supported formats.
- Create and sign manifest data, and attach it to media files in supported formats.
Features:
- Create and sign C2PA manifests using various signing algorithms.
- Verify C2PA manifests and extract metadata.
- Add assertions and ingredients to assets.
- Examples and unit tests to demonstrate usage.
For the best experience, read the docs on the CAI Open Source SDK documentation website.
If you want to view the documentation in GitHub, see:
- Using the Python library
- Supported formats
- Configuring the SDK using
ContextandSettings - Using Builder intents to ensure spec-compliant manifests
- Using working stores and archives
- Selectively constructing manifests by filtering actions and ingredients
- Diagram of public classes in the Python library and their relationships
- Release notes
Prerequisites
This library requires Python version 3.10+.
Package installation
Install the c2pa-python package from PyPI by running:
pip install c2pa-python
To use the module in Python code, import the module like this:
import c2pa
Building from local c2pa-rs sources
Using a virtual environment with local builds
The make targets honor an active virtualenv. Create a virtual environment ./.venv and activate it before running them so commands use the project interpreter rather than the global Python interpreter:
make create-venv && source .venv/bin/activate
Build steps
By default the build downloads a prebuilt native library from a c2pa-rs release. To test the Python bindings against a local, unreleased c2pa-rs checkout, you can instead build the native library from source.
Prerequisites:
- A local clone of c2pa-rs.
- The Rust toolchain (
cargoon yourPATH).
Point C2PA_RS_PATH at your c2pa-rs checkout and run the build-from-source target:
export C2PA_RS_PATH=/path/to/c2pa-rs
make build-from-source C2PA_RS_PATH=$C2PA_RS_PATH
This does a clean build of the c2pa-c-ffi crate (with the file_io feature, which the Python wrapper requires), stages the resulting library under both artifacts/ and src/c2pa/libs/, and installs the package in editable mode, replacing any prebuilt artifacts from make download-native-artifacts. By default, the build uses the release profile; to build the debug profile instead, pass EXTRA_BUILD_ARGS="--debug":
make build-from-source C2PA_RS_PATH=$C2PA_RS_PATH EXTRA_BUILD_ARGS="--debug"
Note on targets for macOS
On macOS this produces a universal (arm64+x86_64) library by default, which requires both Rust targets:
rustup target add aarch64-apple-darwin x86_64-apple-darwin
To build a single-architecture library instead, set C2PA_LIBS_PLATFORM to a specific platform (for example aarch64-apple-darwin).
Examples
See the examples directory for some helpful examples:
examples/read.pyshows how to read and verify an asset with a C2PA manifest.examples/sign.pyshows how to sign and verify an asset with a C2PA manifest.examples/training.pydemonstrates how to add a "Do Not Train" assertion to an asset and verify it.
API reference documentation
Documentation is published at github.io/c2pa-python/api/c2pa.
To build documentation locally, refer to this section in Contributing to the project.
Contributing
Contributions are welcome! For more information, see Contributing to the project.
License
This project is licensed under the Apache License 2.0 and the MIT License. See the LICENSE-MIT and LICENSE-APACHE files for details.
2 maintainers
Metadata
2 maintainers
Release files for c2pa-python 0.38.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| c2pa_python-0.38.0.tar.gz | 137.6 kB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| c2pa_python-0.38.0-py3-none-win_arm64.whl | Python 3 | none | Windows ARM64 | Details |
| c2pa_python-0.38.0-py3-none-win_amd64.whl | Python 3 | none | Windows x86-64 | Details |
| c2pa_python-0.38.0-py3-none-manylinux_2_28_x86_64.whl | Python 3 | none | Linux glibc 2.28+ x86-64 | Details |
| c2pa_python-0.38.0-py3-none-manylinux_2_28_aarch64.whl | Python 3 | none | Linux glibc 2.28+ ARM64 | Details |
| c2pa_python-0.38.0-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details |
| c2pa_python-0.38.0-py3-none-macosx_10_9_x86_64.whl | Python 3 | none | macOS 10.9+ x86-64 | Details |
| c2pa_python-0.38.0-py3-none-macosx_10_9_universal2.whl | Python 3 | none | macOS 10.9+ universal2 (ARM64, x86-64) | Details |
Total release size: 249.5 MB
Release files / c2pa_python-0.38.0.tar.gz
| Download URL | c2pa_python-0.38.0.tar.gz |
|---|---|
| Size | 137.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
3a40dab7424e03b397f5c4c81298d7f534a28e7d75a17d5d39fdc35c5dfe5963
|
|
BLAKE2b-256 checksum How to use checksums |
76b12ff409fdfe7304fc2e4074ebbe8079274e21bdbbf60b34bd7f9a3e60670f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / c2pa_python-0.38.0-py3-none-win_arm64.whl
| Download URL | c2pa_python-0.38.0-py3-none-win_arm64.whl |
|---|---|
| Size | 85.3 MB |
| Tags | Python 3 Windows ARM64 |
|
SHA-256 checksum How to use checksums |
abac93851169c016aadb7251177656c3919af5ce469c011ff4ea014bd02501b4
|
|
BLAKE2b-256 checksum How to use checksums |
f8cea4550a56b5f1b1f898c1081145606d6a64e26d93eb7c6bf51f11da899d4a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / c2pa_python-0.38.0-py3-none-win_amd64.whl
| Download URL | c2pa_python-0.38.0-py3-none-win_amd64.whl |
|---|---|
| Size | 87.9 MB |
| Tags | Python 3 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
5db598a420242229a802c07e84890adb5162aac79afb110e4563c56f33e35256
|
|
BLAKE2b-256 checksum How to use checksums |
319b075dac1e82584faa7b69dfa08d101d9c82872972f3f4a8a93a117c706d97
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / c2pa_python-0.38.0-py3-none-manylinux_2_28_x86_64.whl
| Download URL | c2pa_python-0.38.0-py3-none-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 15.3 MB |
| Tags | Linux glibc 2.28+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
9739589e69e5891da80d9b2cc2549c8a9b224d9131cafed4582d5746a155fd2d
|
|
BLAKE2b-256 checksum How to use checksums |
a84085a91e6262e0399e88596f79b73d2953f68db98aa1c8b18225121c7bcd70
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / c2pa_python-0.38.0-py3-none-manylinux_2_28_aarch64.whl
| Download URL | c2pa_python-0.38.0-py3-none-manylinux_2_28_aarch64.whl |
|---|---|
| Size | 14.7 MB |
| Tags | Linux glibc 2.28+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
dcdc16c23178cb580c1017dca88ca2f6f516b3748ecf4c69acfff78ea385feb8
|
|
BLAKE2b-256 checksum How to use checksums |
eb8874711ff71b5c4448322e5af27160e5f4032bda8dec9ab4c6534733e119b9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / c2pa_python-0.38.0-py3-none-macosx_11_0_arm64.whl
| Download URL | c2pa_python-0.38.0-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 14.5 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
53364e6b02b2c26863419f444bb6390e8c4c4095eb0e3c3373c7144e7a7ff363
|
|
BLAKE2b-256 checksum How to use checksums |
093c04b75a601202c8e90116472e325dc2ae2c1f371153b8b8244e8b1b619ca2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / c2pa_python-0.38.0-py3-none-macosx_10_9_x86_64.whl
| Download URL | c2pa_python-0.38.0-py3-none-macosx_10_9_x86_64.whl |
|---|---|
| Size | 14.8 MB |
| Tags | Python 3 macOS 10.9+ x86-64 |
|
SHA-256 checksum How to use checksums |
d1b5522673c0df8b64f85fc9f55bab5f211920fb571669bd8461a8ffe7e3a287
|
|
BLAKE2b-256 checksum How to use checksums |
691c2fab71e40c510ccaad4f2032f751f336d027b2235f10fe41f09cf44fffb7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency logRelease files / c2pa_python-0.38.0-py3-none-macosx_10_9_universal2.whl
| Download URL | c2pa_python-0.38.0-py3-none-macosx_10_9_universal2.whl |
|---|---|
| Size | 16.9 MB |
| Tags | Python 3 macOS 10.9+ universal2 (ARM64, x86-64) |
|
SHA-256 checksum How to use checksums |
334ffbff033423c910f1e635447cd775c1d66874e02b6db55d6f62d7a5a856fc
|
|
BLAKE2b-256 checksum How to use checksums |
8ed990ad8810bb0638da95bd5ad814dd15cb843886edb9b6eeab3f1c6c139db1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 29, 2026.
Transparency log
