Trufo Provenance

Trufo Provenance is Trufo's core content-provenance engine for C2PA manifest generation, validation, remote signing integration, cryptographic signers, and shared provenance types. It is a lower-level building block used by Trufo's hosted services and SDKs; most application developers should install the public trufo SDK instead of importing this package directly.

This package is in an alpha release state. APIs and schemas may change until the package enters beta.

Installation

Most SDK users should install provenance support through the public trufo SDK:

pip install "trufo[provenance]"

That SDK extra resolves this package as an implementation dependency. Direct installation is primarily for maintainers, service deployments, and low-level integration testing:

pip install "trufo-provenance[c2pa]"

The c2pa extra on trufo-provenance installs the Python dependencies needed by the C2PA media pipeline, such as image/video helpers and file-type detection. The native c2pa-rs bridge is bundled in the Linux wheel itself.

The distribution name is trufo-provenance; the Python import package is tfprov for historical compatibility:

import tfprov

Python 3.10 or newer is required. Version 0.1.0 publishes Linux wheels with the native c2pa-rs bridge bundled. macOS and Windows wheels are not published yet.

What's in here

• tfprov.c2pa_py — C2PA manifest build/parse helpers, assertions, and schemas.
• tfprov.c2pa_rs_bridge — ctypes loader and FFI wrappers for the native c2pa-rs bridge.
• tfprov.c2pa_generator — Trufo claim-generation orchestration used by hosted and SDK signing flows.
• tfprov.crypt — signing algorithms, key handling, local signers, KMS signers, and remote signers.
• tfprov.util — shared media, file, and AWS helpers.

Relationship to other Trufo packages

• trufo-provenance — this package; the lower-level provenance engine.
• trufo — the public Python SDK. SDK users install trufo directly; optional SDK features import trufo-provenance from its published wheel.
• trufo-server — Trufo's hosted services. Server deployments use this library directly from the repository/deployment environment rather than through the trufo SDK extra.

Documentation

User-facing SDK documentation lives in the trufo package. This package is documented primarily for maintainers and service integrations.

Native (Rust) C2PA path

The C2PA signing and validation path is backed by a Rust cdylib bridge loaded through ctypes. The Linux wheel includes libc2pa_rs_bridge.so alongside tfprov.c2pa_rs_bridge. macOS and Windows native wheels are future work.

License

This package is distributed under the proprietary Trufo license in LICENSE. Using Trufo hosted APIs also requires valid Trufo API credentials.

Contributing

See CONTRIBUTING.md. During alpha, external issues are welcome; external pull requests are not accepted.