crates.io docs.rs CI OpenSSF Scorecard License

Overview

Implements the ZIP embedding method from the C2PA Technical Specification. Many document formats are ZIP archives with a fixed internal layout — EPUB, Office Open XML (DOCX/XLSX/PPTX), OpenDocument (ODT/ODS/ODP) and OpenXPS — and all embed a C2PA Manifest Store through this single transport.

The Manifest Store is stored as a dedicated ZIP entry at a fixed location:

Property Value
Path META-INF/content_credential.c2pa
Compression Stored (method 0, uncompressed)
Encryption None
General-purpose bit flag 0
Media type As recommended for external manifests

Embedding appends the manifest entry before the central directory, so existing entries keep their byte offsets; the central directory and end-of-central-directory record are then rebuilt. All parsing is bounds-checked against untrusted input, and ZIP64 archives are rejected (fail-closed) rather than mis-parsed.

Zero dependencies.

Quick Start

[dependencies]
c2pa-zip = "0.1"

Embed a manifest

use c2pa_zip::embed_manifest;

let doc: &[u8] = /* .epub / .docx / .odt / .oxps bytes */;
let manifest: &[u8] = /* C2PA Manifest Store bytes */;

// Insert (or replace) the manifest entry; existing entries stay byte-stable.
let signed = embed_manifest(doc, manifest).unwrap();

Read a manifest

use c2pa_zip::read_manifest;

// Some(bytes) when a manifest is present, None when the archive has none.
let manifest = read_manifest(&signed).unwrap();

Remove a manifest

use c2pa_zip::remove_manifest;

let stripped = remove_manifest(&signed).unwrap();

Verify structurally

use c2pa_zip::verify;

let report = verify(&signed).unwrap();
// report.has_manifest, report.manifest_len, report.is_valid_zip

Design

  • The Manifest Store is a single stored (uncompressed) ZIP entry at META-INF/content_credential.c2pa
  • embed_manifest replaces any existing manifest entry, so the archive always carries at most one; when none is present the existing entries keep their exact byte offsets
  • remove_manifest rebuilds the archive without the manifest entry, recomputing local-header offsets and the central directory
  • verify reports transport-level structure only: whether the archive parses and whether a manifest is present
  • ZIP64 archives (identified by sentinel values in the EOCD or central directory) are rejected; a trailing ZIP comment is tolerated when locating the EOCD

Scope

This crate is the ZIP transport only: it reads, writes, and removes a C2PA Manifest Store stored as a ZIP entry. Manifest construction, signing, and hard/soft binding (the collection-data-hash) are out of scope; use the c2pa SDK for those. verify performs structural checks (presence + parseability), not hard-binding validation.

Related Crates

Part of a family of single-purpose crates, one per C2PA embedding method. Each is standalone and independently versioned.

Crate Description
c2pa-structured-text Structured text: ASCII-armoured manifest in a comment or front matter
c2pa-unstructured-text Unstructured text: invisible Unicode variation-selector run
c2pa-html HTML: script and link elements in the document head
c2pa-http HTTP: the c2pa-manifest Link header, with a Tower middleware
c2pa-text-binding Soft binding and content fingerprinting for text assets
c2pa-vtt WebVTT caption and subtitle embedding
c2pa-warc WARC web archive embedding (ISO 28500)
c2pa-fonts OpenType/TrueType (SFNT) font embedding
c2pa-ml ML model containers: GGUF, SafeTensors, ONNX
c2pa Official C2PA SDK

Security

Found a vulnerability? Please report it privately — see SECURITY.md.

License

Licensed under either of Apache License, Version 2.0 or MIT License at your option.

Built by WritersLogic

Project links

Data verified by PyPI on Aug 2, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for dcondrey from gravatar.com dcondrey

GitHub Statistics

Data verified by PyPI on Aug 2, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT OR Apache-2.0

Requires

Python >=3.9

Tags

c2pa provenance zip epub ocf

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

c2pa_zip-0.2.0.tar.gz (31.4 kB view details)

Uploaded Source

Built Distributions

If you're not sure about the file name format, learn more about wheel file names.

c2pa_zip-0.2.0-cp39-abi3-win_amd64.whl (122.6 kB view details)

Uploaded CPython 3.9+Windows x86-64

c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (256.6 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ x86-64

c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl (251.4 kB view details)

Uploaded CPython 3.9+manylinux: glibc 2.17+ ARM64

c2pa_zip-0.2.0-cp39-abi3-macosx_11_0_arm64.whl (226.8 kB view details)

Uploaded CPython 3.9+macOS 11.0+ ARM64

c2pa_zip-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl (229.3 kB view details)

Uploaded CPython 3.9+macOS 10.12+ x86-64

File details

Details for the file c2pa_zip-0.2.0.tar.gz.

File metadata

  • Download URL: c2pa_zip-0.2.0.tar.gz
  • Upload date:
  • Size: 31.4 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for c2pa_zip-0.2.0.tar.gz
Algorithm Hash digest
SHA256 b4953afdb2a4535208ed5c6a76f2dd45aa0b0cec92a63a33d30207960519a05d
MD5 b9d42a3dee92fdb49018701eb3fcad5c
BLAKE2b-256 595b9fc5f63bce82ba0d5a41104d0f71cfa82a6792af93405569c41814192992

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.2.0.tar.gz:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.2.0-cp39-abi3-win_amd64.whl.

File metadata

  • Download URL: c2pa_zip-0.2.0-cp39-abi3-win_amd64.whl
  • Upload date:
  • Size: 122.6 kB
  • Tags: CPython 3.9+, Windows x86-64
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for c2pa_zip-0.2.0-cp39-abi3-win_amd64.whl
Algorithm Hash digest
SHA256 b435257ec6a880a74658ec90d37989bf8b8b2e24db1bd2c1f8ad263e5037d7ed
MD5 5fce5e94f47d7857941b1e64ad4a5980
BLAKE2b-256 590ced1bd6c2366b98cd9aab5e38aee89a66742556f252e563429933017234a3

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.2.0-cp39-abi3-win_amd64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 44a6f48844705b156b33a99d4f49fe9ef5958ec1eaac50ccd670fb1a71bfd55e
MD5 9377fcc2c319de0d1ed8757ffa13cb95
BLAKE2b-256 fe38c6ec0cee27616bee847a513cc4706a0424dbd0517ea44037bb39573bc66c

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
Algorithm Hash digest
SHA256 ada60188d9a376c47f3e7e829294583fbeafeccf1ba8cba767765e39743d774a
MD5 522bd933e9f4a193f522b0e5cc4257ac
BLAKE2b-256 f5343e426e628a36b7347670b11c217af64bfbadfde3e785fcff681730d07d21

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.2.0-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.2.0-cp39-abi3-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.2.0-cp39-abi3-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 da4f457e1822c34d69d20ccc24f6332e56459b21ec181e0af26f0d07a7b6e2c5
MD5 831bb92b24c65afac8c498ec2cd591ba
BLAKE2b-256 f702a33d09b5c14c902847319918b0f7b53551015cc2249c2259cef4cd2806aa

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.2.0-cp39-abi3-macosx_11_0_arm64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file c2pa_zip-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl.

File metadata

File hashes

Hashes for c2pa_zip-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl
Algorithm Hash digest
SHA256 10ac066ff2961bc13a172e46811e6edb2645b8ad95872215ec8863f925046aca
MD5 94943aaddb771aef44f595a573e7df85
BLAKE2b-256 88543f621b75e7aabc55c688bd9efd333f9bfe16643f8874ce1bdeb935f8d23a

See more details on using hashes here.

Provenance

The following attestation bundles were made for c2pa_zip-0.2.0-cp39-abi3-macosx_10_12_x86_64.whl:

Publisher: release.yml on writerslogic/c2pa-zip

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

0.2.0 This release

6 files

0.1.0

6 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page