Transaction Science 0c19c60ad9 wai: live provenance, derived manifest identifiers, dynamic packaging and repository receipts ...

C2PA 2.4 extends live video to dynamically packaged content and recommends
deterministic signatures for streaming (§19.2.1, §13.2.1, naming ISO/IEC 23009-9);
it adds the repository receipt assertion (§18.27). Every manifest identifier is now
derived from the stream, a role and the segment's sequence number, so packagers that
share a key write identical segments and packagers that do not chain across a
failover. The initialization manifest may carry an update manifest with the parent
as ingredient and a c2pa.repository-receipt whose proof is an RFC 9942 receipt of
inclusion in an RFC 9162 log, verified against the repository's key.

Three reasons: manifest_id_mismatch, update_manifest_invalid and
repository_receipt_invalid; a failover vector, a registered vector and their
negatives; c2pa_live_verify.py reads all of it from the text. The CI step, the
registry entry and its export, SPEC §5, the CHANGELOG, the live-conformance README
and capture-binding §11 come with it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-21 04:49:42 -04:00

3.7 KiB

Raw Permalink History

View raw