crates.io docs.rs CI OpenSSF Scorecard License

Overview

Implements the ZIP embedding method from the C2PA Technical Specification. Many document formats are ZIP archives with a fixed internal layout — EPUB, Office Open XML (DOCX/XLSX/PPTX), OpenDocument (ODT/ODS/ODP) and OpenXPS — and all embed a C2PA Manifest Store through this single transport.

The Manifest Store is stored as a dedicated ZIP entry at a fixed location:

Property Value
Path META-INF/content_credential.c2pa
Compression Stored (method 0, uncompressed)
Encryption None
General-purpose bit flag 0
Media type As recommended for external manifests

Embedding appends the manifest entry before the central directory, so existing entries keep their byte offsets; the central directory and end-of-central-directory record are then rebuilt. All parsing is bounds-checked against untrusted input, and ZIP64 archives are rejected (fail-closed) rather than mis-parsed.

Zero dependencies.

Quick Start

[dependencies]
c2pa-zip = "0.1"

Embed a manifest

use c2pa_zip::embed_manifest;

let doc: &[u8] = /* .epub / .docx / .odt / .oxps bytes */;
let manifest: &[u8] = /* C2PA Manifest Store bytes */;

// Insert (or replace) the manifest entry; existing entries stay byte-stable.
let signed = embed_manifest(doc, manifest).unwrap();

Read a manifest

use c2pa_zip::read_manifest;

// Some(bytes) when a manifest is present, None when the archive has none.
let manifest = read_manifest(&signed).unwrap();

Remove a manifest

use c2pa_zip::remove_manifest;

let stripped = remove_manifest(&signed).unwrap();

Verify structurally

use c2pa_zip::verify;

let report = verify(&signed).unwrap();
// report.has_manifest, report.manifest_len, report.is_valid_zip

Design

  • The Manifest Store is a single stored (uncompressed) ZIP entry at META-INF/content_credential.c2pa
  • embed_manifest replaces any existing manifest entry, so the archive always carries at most one; when none is present the existing entries keep their exact byte offsets
  • remove_manifest rebuilds the archive without the manifest entry, recomputing local-header offsets and the central directory
  • verify reports transport-level structure only: whether the archive parses and whether a manifest is present
  • ZIP64 archives (identified by sentinel values in the EOCD or central directory) are rejected; a trailing ZIP comment is tolerated when locating the EOCD

Scope

This crate is the ZIP transport only: it reads, writes, and removes a C2PA Manifest Store stored as a ZIP entry. Manifest construction, signing, and hard/soft binding (the collection-data-hash) are out of scope; use the c2pa SDK for those. verify performs structural checks (presence + parseability), not hard-binding validation.

Related Crates

Crate Description
c2pa-fonts OpenType/TrueType (SFNT) font embedding
c2pa-warc WARC web archive embedding (ISO 28500)
c2pa-structured-text Structured text embedding via ASCII armour delimiters
c2pa-text-binding Soft binding and content fingerprinting for text assets
c2pa-rs Official C2PA SDK

Security

Found a vulnerability? Please report it privately — see SECURITY.md.

License

Licensed under either of Apache License, Version 2.0 or MIT License at your option.

Built by WritersLogic

Project links

Data verified by PyPI on Jul 31, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.2.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for dcondrey from gravatar.com dcondrey

GitHub Statistics

Data verified by PyPI on Jul 31, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT OR Apache-2.0

Requires

Python >=3.9

Tags

c2pa provenance zip epub ocf

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

c2pa_zip-0.1.0.tar.gz (24.6 kB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

c2pa_zip-0.1.0-cp39-abi3-win_amd64.whl (122.4 kB view details)

Uploaded CPython 3.9+Windows x86-64

c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (256.3 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (251.1 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ ARM64

c2pa_zip-0.1.0-cp39-abi3-macosx_11_0_arm64.whl (226.6 kB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

c2pa_zip-0.1.0-cp39-abi3-macosx_10_12_x86_64.whl (229.1 kB view details)

Uploaded CPython 3.9+macOS 10.12+ x86-64

File details

Details for the file c2pa_zip-0.1.0.tar.gz.

File metadata

  • Download URL: c2pa_zip-0.1.0.tar.gz
  • Upload date:
  • Size: 24.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for c2pa_zip-0.1.0.tar.gz
Algorithm Hash digest
SHA256 52f4181ae5759fba8b84cc6d959d2403adcf69cd71c7c81780ae3bc0e2297e4c
MD5 4ac572280c5030a5093ad0a08602135b
BLAKE2b-256 437218189dc83709964527f64402985046a050ba655e643f211e76c431d02033

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.1.0.tar.gz:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.1.0-cp39-abi3-win_amd64.whl.

File metadata

  • Download URL: c2pa_zip-0.1.0-cp39-abi3-win_amd64.whl
  • Upload date:
  • Size: 122.4 kB
  • Tags: CPython 3.9+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for c2pa_zip-0.1.0-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 fdc2c35bf439e3796cad9e6c5ac7e770e8197e5b6d7471b3d9dafde09b59e46d
MD5 204b180d85c357046e697086b646392e
BLAKE2b-256 5d63369150aa89a12a7f68c91865f45ddbb66324d17c69ecb0047300262e4a7c

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.1.0-cp39-abi3-win_amd64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 7ff0f3f677b284b94ec469ece5dea90ad75a0778473faa859c336b8b714a5c2b
MD5 88d3fe410d292ffc2e9d39faf89e7a12
BLAKE2b-256 7cab48efa07722261b7b83ace3f82300e7ab36228b383ac5044b62a24bab1d3f

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
Algorithm Hash digest
SHA256 9d5ef1719026532a5bd2378c5c7ab826d7a3a6106681820e59837c7cd07d641f
MD5 ff5d1c12d8b7f651cfd6e991651b5cf1
BLAKE2b-256 9e77f9a6b6e77055071016c4ef8416ee1af5e261e4e197b3b046bb959a4890b7

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.1.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.1.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.1.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 84c343dacca48f2234c735001eab777a606b356a78e37c8f3053364425b18762
MD5 ee2c5774fecfafcc20746751f1956bff
BLAKE2b-256 bfef11dd281e62dd0be2b3052c7900228a2ed72afeef15096694dcf7d0693d84

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.1.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.1.0-cp39-abi3-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.1.0-cp39-abi3-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 bf6f8fe2c4b40980587defabad1cc98d3c7d5f284b8f91fb358a4aa94d38d8f6
MD5 1e5e982a28fe922575b9d5c205aca140
BLAKE2b-256 771e5941380fe18132010f4e9c272e28995c7d5701ed2ff281b8dc88b471ad9e

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.1.0-cp39-abi3-macosx_10_12_x86_64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.2.0

6 files

This release

0.1.0 This release

6 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page