crates.io docs.rs CI OpenSSF Scorecard License

Overview

Embeds, extracts, and hard-binds a C2PA Manifest Store reference in WebVTT files. The manifest is carried in a single-line NOTE comment using the fixed ASCII armour delimiters, placed immediately after the WEBVTT signature (where it survives HLS/DASH segmentation), per the C2PA structured text embedding rules.

Canonical owner of WebVTT. WebVTT is structured text per the specification, so the general c2pa-structured-text crate could embed into it via the NOTE comment style — but this crate owns .vtt. It targets the streaming-safe placement after the WEBVTT signature and validates the header. Use this crate for WebVTT; use c2pa-structured-text for other structured text.

WEBVTT

NOTE -----BEGIN C2PA MANIFEST----- https://example.com/m.c2pa -----END C2PA MANIFEST-----

00:00:00.000 --> 00:00:05.000
Hello world

Scope: this crate vs. c2pa-structured-text

The C2PA structured text embedding section covers WebVTT as one comment style (NOTE), and c2pa-structured-text implements that general method. This crate is the canonical WebVTT implementation; c2pa-structured-text documents the WebVTT delimiter but defers placement and hard binding here. WebVTT needs format awareness that the general method lacks:

  • Placement. The general "prepend a comment line" rule would put the block before the WEBVTT signature and produce an invalid file. WebVTT reserves its first line, so the block goes immediately after it, with blank-line separation.
  • Hard binding. Computing and validating the c2pa.hash.data exclusion range requires locating the NOTE block within valid WebVTT structure (cues, STYLE/REGION blocks, author comments).

There is no silently-overlapping second implementation: c2pa-structured-text points to this crate for WebVTT.

Hard binding

WebVTT is a structured text container, so its hard binding is a byte-exact c2pa.hash.data data hash carrying a single exclusion range that covers the manifest NOTE block. The hash is computed over the raw bytes of the file with that one range removed: the WEBVTT signature, every cue, STYLE/REGION block, and author comment is bound; only the manifest block itself is excluded.

  • No normalization. Unlike the unstructured-text (Unicode Variation Selector) method, structured text hashing applies no Unicode normalization. The file is byte-stable on disk and the ASCII delimiters make the excluded range unambiguous; applying NFC would create false mismatches for legitimate NFD content in cue text.
  • Line terminators. LF or CRLF only; the file's convention is preserved and bare CR is not supported (per the spec).
  • Exclusion range. [offset, offset + length) of the NOTE line including its trailing terminator — exactly the value returned by [data_hash_exclusion] and the offset/length on [extract_manifest].

A byte-exact hard binding is therefore feasible and implemented here. It is fragile under re-encoding that changes bytes outside the manifest block (line-ending conversion, BOM insertion, trailing-whitespace edits) — inherent to any hard binding over a text container. For robustness against such transformations, pair it with a soft binding from c2pa-text-binding.

Quick Start

[dependencies]
c2pa-vtt = "0.2"

Generate: embed a reference and compute the hard binding

use c2pa_vtt::{embed_manifest, compute_data_hash, ManifestRef, HashAlg};

let vtt = "WEBVTT\n\n00:00:00.000 --> 00:00:05.000\nHello\n";
let signed = embed_manifest(vtt, ManifestRef::Url("https://example.com/m.c2pa")).unwrap();

// The value for the c2pa.hash.data assertion's `hash` field (alg = HashAlg::c2pa_id).
let hash = compute_data_hash(&signed, HashAlg::Sha256).unwrap();

A manifest store may instead be embedded inline with ManifestRef::Embedded(&store_bytes), encoded as a data:application/c2pa;base64,... reference.

Verify: extract and check the hard binding

use c2pa_vtt::{extract_manifest, verify_data_hash, HashAlg};

let result = extract_manifest(&signed).unwrap();
assert_eq!(result.reference, "https://example.com/m.c2pa");

let ok = verify_data_hash(&signed, HashAlg::Sha256, &hash).unwrap();

Remove

use c2pa_vtt::remove_manifest;

let clean = remove_manifest(&signed).unwrap();

Validation bridge

Hard-binding validation is owned by this crate (c2pa-rs has no stable native text/vtt handler). Everything else — COSE signature, certificate trust, timestamp, and assertion validation of the manifest store — is delegated to c2pa-rs.

extract_manifest_source (zero dependencies) resolves the reference, decoding an inline data: URI to raw store bytes:

use c2pa_vtt::{extract_manifest_source, ManifestSource};

match extract_manifest_source(&signed).unwrap() {
    ManifestSource::Url(url) => { /* fetch the store; this crate performs no network I/O */ }
    ManifestSource::Embedded(bytes) => { /* raw C2PA Manifest Store */ }
}

With the c2pa feature enabled, bridge::validate(vtt, &store_bytes) hands the store to a c2pa-rs Reader; inspect validation_state() / validation_status(), and validate the WebVTT hard binding with verify_data_hash.

Features

Feature Default Adds
hash ✅ sha2-backed compute_data_hash / verify_data_hash
c2pa bridge::validate delegation to c2pa-rs (pulls in the c2pa crate)

Build with default-features = false for a zero-dependency embed/extract build.

Conformance

This crate implements the structured text embedding and data hash for WebVTT as specified, and delegates signature/trust validation to c2pa-rs. It makes no conformance or certification claim; validate against the C2PA specification and a reference C2PA tool for interop.

Related Crates

Part of a family of single-purpose crates, one per C2PA embedding method. Each is standalone and independently versioned.

Crate Description
c2pa-structured-text Structured text: ASCII-armoured manifest in a comment or front matter
c2pa-unstructured-text Unstructured text: invisible Unicode variation-selector run
c2pa-html HTML: script and link elements in the document head
c2pa-http HTTP: the c2pa-manifest Link header, with a Tower middleware
c2pa-text-binding Soft binding and content fingerprinting for text assets
c2pa-zip ZIP-based documents: EPUB, DOCX, ODT, OXPS
c2pa-warc WARC web archive embedding (ISO 28500)
c2pa-fonts OpenType/TrueType (SFNT) font embedding
c2pa-ml ML model containers: GGUF, SafeTensors, ONNX
c2pa Official C2PA SDK

Security

Found a vulnerability? Please report it privately — see SECURITY.md.

License

Licensed under either of Apache License, Version 2.0 or MIT License at your option.

Built by WritersLogic

Project links

Data verified by PyPI on Aug 2, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for dcondrey from gravatar.com dcondrey

GitHub Statistics

Data verified by PyPI on Aug 2, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT OR Apache-2.0

Requires

Python >=3.9

Tags

c2pa provenance webvtt subtitles captions

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

c2pa_vtt-0.2.0.tar.gz (52.1 kB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

c2pa_vtt-0.2.0-cp39-abi3-win_amd64.whl (144.0 kB view details)

Uploaded CPython 3.9+Windows x86-64

c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (277.4 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (268.4 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ ARM64

c2pa_vtt-0.2.0-cp39-abi3-macosx_11_0_arm64.whl (239.1 kB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

c2pa_vtt-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl (248.6 kB view details)

Uploaded CPython 3.9+macOS 10.12+ x86-64

File details

Details for the file c2pa_vtt-0.2.0.tar.gz.

File metadata

  • Download URL: c2pa_vtt-0.2.0.tar.gz
  • Upload date:
  • Size: 52.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for c2pa_vtt-0.2.0.tar.gz
Algorithm Hash digest
SHA256 a95681bd956e58a29e5070af1fee93b2d0286012024a2f39f89a9b88488ebb5b
MD5 2838b0d11cb69c48c91d9f4d052a9829
BLAKE2b-256 14d449afcd31d67a1c9e040b8de4a9d180fc7b81ade838c5841416db40929394

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_vtt-0.2.0.tar.gz:

Publisher: release.yml on writerslogic/c2pa-vtt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_vtt-0.2.0-cp39-abi3-win_amd64.whl.

File metadata

  • Download URL: c2pa_vtt-0.2.0-cp39-abi3-win_amd64.whl
  • Upload date:
  • Size: 144.0 kB
  • Tags: CPython 3.9+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for c2pa_vtt-0.2.0-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 0c6808fb4d3d91f84e7dad3ab3d8da6841e9e9ac4fbf5f98029a3ba46308b350
MD5 ded6144b475d7031ef932ea1df0efcc2
BLAKE2b-256 1812c410743355d5d0578406f7e3cbdb14d8f7e145b6ad660854f2c1bf9b2f56

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_vtt-0.2.0-cp39-abi3-win_amd64.whl:

Publisher: release.yml on writerslogic/c2pa-vtt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 fc7232d7bcb4cb81ee32bb98e0c2c5670f2e3a2ad98edc6f37d7eedfc8554757
MD5 80db704613da367fb3e0d01c15438118
BLAKE2b-256 75e945ab8d0144db900bf1cb280b4c24879c6a1990ec730908aaf8d7ffaf5d67

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: release.yml on writerslogic/c2pa-vtt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl.

File metadata

File hashes

Hashes for c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
Algorithm Hash digest
SHA256 bf4f5380318e4b6b9dfd09aa46c9c4d9163b730e33c145137bbdc786ff9d7caa
MD5 0574680f6f77a0816a51769cf9849ed7
BLAKE2b-256 723f72b9b79487ca34755c6ab71fe3b45c44da4aa3497fa3da576310225dbf9c

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_vtt-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl:

Publisher: release.yml on writerslogic/c2pa-vtt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_vtt-0.2.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for c2pa_vtt-0.2.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 718c9e065a9aa09704be3773c0ae16dfab3320c146f4a5a49a8b63573dac7cc9
MD5 8840daee2ea07d199fca1bee79ea8c8d
BLAKE2b-256 12586c6bb45c157913a83ff0c2b662e4e4012980df99fd223c7825a785bd9020

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_vtt-0.2.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: release.yml on writerslogic/c2pa-vtt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_vtt-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for c2pa_vtt-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 8c53a34c651e862489636f8eba8bcd259654b9aaa583293de6e8cfa5d2167fa4
MD5 4aa56e519a43ee67b538337b5b9f3e86
BLAKE2b-256 b58eecaedd5efcd67eb20d5a1dfb44ad20c86b917dc306792845840dee2e9c0f

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_vtt-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl:

Publisher: release.yml on writerslogic/c2pa-vtt

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

0.2.0 This release

6 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page