Import C2PA signing authorities + fixes

Release/UpgradeVersion.sh

@@ -113,4 +113,34 @@ cat - <<EOF > "${rpm_changelog}.new"
 EOF
 
 sed -i "1e cat ${rpm_changelog}.new" "${rpm_changelog}"
-rm -f "${rpm_changelog}.new"
+rm -f "${rpm_changelog}.new"
+
+#-----------------------------------------------------------------------
+# Update the bundled default C2PA trust anchors (signing + TSA) from the
+# public C2PA conformance repository
+c2pa_ca_header="${release_directory}/../Source/Riff/Riff_C2PA_Helpers_CA.h"
+c2pa_ca_tmp="$(mktemp)"
+trap 'rm -f "${c2pa_ca_tmp}"' EXIT
+
+curl -sL --fail \
+    "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/trust-list/C2PA-TRUST-LIST.pem" \
+    "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/trust-list/C2PA-TSA-TRUST-LIST.pem" \
+    | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\t/\\t/g' -e 's/^/"/' -e 's/$/\\n"/' \
+    > "${c2pa_ca_tmp}"
+
+awk -v newblock_file="${c2pa_ca_tmp}" -v date="$(LC_ALL=C date -u -R)" '
+    /AUTOGENERATED-BEGIN/ {
+        printf "\n"
+        printf "// This block was automatically generated by UpgradeVersion.sh on %s\n", date
+        printf "// from the C2PA conformance repository at https://github.com/c2pa-org/conformance-public\n"
+        printf "static const char* C2PA_TrustAnchors_Default ="
+        while ((getline line < newblock_file) > 0)
+            printf "\n    %s", line
+        printf ";\n"
+        skip=1
+        next
+    }
+    /AUTOGENERATED-END/ { skip=0 }
+    !skip
+' "${c2pa_ca_header}" > "${c2pa_ca_header}.new"
+mv "${c2pa_ca_header}.new" "${c2pa_ca_header}"

Source/CLI/CLI_Help.cpp

@@ -190,6 +190,8 @@ std::string Help()
     ToDisplay<<"--C2PA-Sign-Key=        Path to the PEM private key"<<std::endl;
     ToDisplay<<"--C2PA-Sign-Algorithm=  Signing algorithm (e.g. es256)"<<std::endl;
     ToDisplay<<"--C2PA-Sign-TA-URL=     Optional RFC3161 timestamp authority URL"<<std::endl;
+    ToDisplay<<"--C2PA-User-Anchors=    Path to a PEM bundle of additional trust anchor root certificates,"<<std::endl;
+    ToDisplay<<"                        used when verifying signatures (e.g. for a private/test CA)"<<std::endl;
     ToDisplay<<""<<std::endl;
     ToDisplay<<"*******************************************************************************"<<std::endl;
     #endif // defined(ENABLE_C2PA)

Source/CLI/CommandLine_Parser.cpp

@@ -173,6 +173,7 @@ int Parse(Core &C, string &Argument)
     OPTION("--c2pa-sign-key=",                              C2PA_Sign_Key)
     OPTION("--c2pa-sign-algorithm=",                        C2PA_Sign_Algorithm)
     OPTION("--c2pa-sign-ta-url=",                           C2PA_Sign_TA_URL)
+    OPTION("--c2pa-user-anchors=",                          C2PA_UserAnchors)
     #endif // defined(ENABLE_C2PA)
     //Default
     OPTION("--",                                            Default)
@@ -1155,6 +1156,31 @@ CL_OPTION(C2PA_Sign_TA_URL)
 
     return -2; //Continue
 }
+
+//---------------------------------------------------------------------------
+CL_OPTION(C2PA_UserAnchors)
+{
+    #if defined(C2PA_DYNAMIC_LOADING)
+    if (!C2PA_Available())
+    {
+        std::cerr<<"C2PA support is not available, please install the plugin."<<std::endl;
+        return 1;
+    }
+    #endif // defined(C2PA_DYNAMIC_LOADING)
+
+    //Form : --c2pa-user-anchors=(FileName)
+    string FileName=string().assign(Argument, 20, std::string::npos);
+
+    string Content;
+    if (!ReadWholeFile(FileName, Content))
+    {
+        std::cerr<<"Unable to read the C2PA user anchors: "<<FileName<<std::endl;
+        return 1;
+    }
+    C.C2PA_UserAnchors.assign(Content);
+
+    return -2; //Continue
+}
 #endif // defined(ENABLE_C2PA)
 
 //---------------------------------------------------------------------------

Source/CLI/CommandLine_Parser.h

@@ -129,6 +129,7 @@ CL_OPTION(C2PA_Sign_Certificate);
 CL_OPTION(C2PA_Sign_Key);
 CL_OPTION(C2PA_Sign_Algorithm);
 CL_OPTION(C2PA_Sign_TA_URL);
+CL_OPTION(C2PA_UserAnchors);
 #endif // defined(ENABLE_C2PA)
 
 //---------------------------------------------------------------------------

Source/Common/Core.cpp

@@ -2465,6 +2465,7 @@ void Core::Options_Update(handlers::iterator &Handler)
         Handler->second.Riff->C2PA_SignPrivateKey=C2PA_SignPrivateKey;
         Handler->second.Riff->C2PA_SignAlgorithm=C2PA_SignAlgorithm;
         Handler->second.Riff->C2PA_SignTA_URL=C2PA_SignTA_URL;
+        Handler->second.Riff->C2PA_UserAnchors=C2PA_UserAnchors;
         if (!C2PA_SignManifestJson.empty())
             Handler->second.Riff->C2PA_SignManifestJson=C2PA_SignManifestJson;
         #endif //defined(ENABLE_C2PA)

Source/Common/Core.h

@@ -188,6 +188,7 @@ class Core : public Thread
     string                              C2PA_SignPrivateKey;
     string                              C2PA_SignAlgorithm;
     string                              C2PA_SignTA_URL;
+    string                              C2PA_UserAnchors;
     #endif // defined(ENABLE_C2PA)
     bool                                RevertToRiff;
 

Source/GUI/Qt/GUI_Main.cpp

@@ -579,6 +579,13 @@ void GUI_Main::C2PA_SignTA_URL_Set(const string &Value)
     C->C2PA_SignTA_URL=Value;
     C->Menu_File_Options_Update();
 }
+
+//---------------------------------------------------------------------------
+void GUI_Main::C2PA_UserAnchors_Set(const string &Value)
+{
+    C->C2PA_UserAnchors=Value;
+    C->Menu_File_Options_Update();
+}
 #endif // defined(ENABLE_C2PA)
 
 //---------------------------------------------------------------------------

Source/GUI/Qt/GUI_Main.h

@@ -63,6 +63,7 @@ class GUI_Main : public QMainWindow
     void C2PA_SignPrivateKey_Set(const string &Value);
     void C2PA_SignAlgorithm_Set(const string &Value);
     void C2PA_SignTA_URL_Set(const string &Value);
+    void C2PA_UserAnchors_Set(const string &Value);
     #endif // defined(ENABLE_C2PA)
 
     //Preferences

Source/GUI/Qt/GUI_Main_PerFile.cpp

@@ -322,7 +322,7 @@ Q_INVOKABLE bool PerFileModel::readOnly(const QString& FileName) const {
 
 //---------------------------------------------------------------------------
 Q_INVOKABLE bool PerFileModel::c2paLocked(const QString& FileName) const {
-    return C->C2PA_Reject && C->Get(FileName.toStdString(), "C2PA")!="Absent";
+    return C->C2PA_Reject && C->Get(FileName.toStdString(), "C2PA")!="No";
 }
 
 //---------------------------------------------------------------------------

Source/GUI/Qt/GUI_Main_xxxx_C2PADialog.cpp

@@ -174,7 +174,7 @@ GUI_Main_xxxx_C2PADialog::GUI_Main_xxxx_C2PADialog(Core* _C, const std::string &
     RawText->setReadOnly(true);
     static const int MaxSize=0x100000;
     if (Manifest.empty())
-        RawText->setPlainText(Status=="Absent"?tr("No C2PA manifest present in this file."):tr("A C2PA chunk is present, but its manifest could not be read."));
+        RawText->setPlainText(Status=="No"?tr("No C2PA manifest present in this file."):tr("A C2PA chunk is present, but its manifest could not be read."));
     else if (Manifest.size()<MaxSize)
         RawText->setPlainText(QString::fromUtf8(Manifest.c_str()));
     else
@@ -280,7 +280,7 @@ QLabel* GUI_Main_xxxx_C2PADialog::Build_StatusBanner ()
 {
     QString Text;
     QString Color;
-    if (Status=="Absent")
+    if (Status=="No")
     {
         Text=tr("No C2PA manifest found in this file.");
         Color=GUI_Colors::Neutral();
@@ -489,7 +489,7 @@ QWidget* GUI_Main_xxxx_C2PADialog::Build_Summary ()
 
     if (Manifest.empty())
     {
-        if (Status!="Absent")
+        if (Status!="No")
         {
             QLabel* Hint=new QLabel(tr("Verify that the C2PA library (libc2pa_c) is installed and reachable by this application."));
             Hint->setWordWrap(true);

Source/GUI/Qt/GUI_Main_xxxx__Common.cpp

@@ -324,7 +324,7 @@ void GUI_Main_xxxx__Common::Colors_Update ()
 //---------------------------------------------------------------------------
 void GUI_Main_xxxx__Common::Colors_Update (QTableWidgetItem* Item, const string &FileName, const string &Field)
 {
-    bool C2PALocked=C->C2PA_Reject && C->Get(FileName, "C2PA")!="Absent";
+    bool C2PALocked=C->C2PA_Reject && C->Get(FileName, "C2PA")!="No";
     bool ReadOnly=C->IsReadOnly_Get(FileName) || C2PALocked;
 
     if (!C->IsValid_Get(FileName) || ReadOnly || !Fill_Enabled(FileName, Field, C->Get(FileName, Field=="Cue"?"cuexml":Field)))

Source/GUI/Qt/GUI_Preferences.cpp

@@ -636,6 +636,14 @@ void GUI_Preferences::OnLoad()
     }
     C2PA_SignTA_URL_Edit->setText(Config("C2PA_SignTA_URL").To_UTF8().c_str());
     Main->C2PA_SignTA_URL_Set(C2PA_SignTA_URL_Edit->text().toUtf8().data());
+    C2PA_UserAnchors_Path->setText(Config("C2PA_UserAnchorsPath").To_UTF8().c_str());
+    if (!Config("C2PA_UserAnchorsContent").empty())
+    {
+        QByteArray Decoded=QByteArray::fromBase64(Config("C2PA_UserAnchorsContent").To_UTF8().c_str());
+        Main->C2PA_UserAnchors_Set(string(Decoded.constData(), (size_t)Decoded.size()));
+    }
+    else
+        Main->C2PA_UserAnchors_Set(string());
     #endif // defined(ENABLE_C2PA)
 }
 
@@ -805,6 +813,22 @@ void GUI_Preferences::OnSave()
         Prefs.Write(Content);
         Main->C2PA_SignTA_URL_Set(C2PA_SignTA_URL_Edit->text().toUtf8().data());
     }
+    {
+        Ztring Content;
+        Content+=__T("C2PA_UserAnchorsPath");
+        Content+=__T(" = ");
+        Content+=Ztring().From_UTF8(C2PA_UserAnchors_Path->text().toUtf8().data());
+        Content+=EOL;
+        Prefs.Write(Content);
+    }
+    {
+        Ztring Content;
+        Content+=__T("C2PA_UserAnchorsContent");
+        Content+=__T(" = ");
+        Content+=Ztring().From_UTF8(QString(QByteArray(C->C2PA_UserAnchors.data(), (int)C->C2PA_UserAnchors.size()).toBase64()).toStdString());
+        Content+=EOL;
+        Prefs.Write(Content);
+    }
     #endif // defined(ENABLE_C2PA)
 
     //Menu
@@ -1083,6 +1107,25 @@ void GUI_Preferences::OnC2PA_SignPrivateKey_BrowseClicked (bool)
     C2PA_SignPrivateKey_Path->setText(FileName);
     Main->C2PA_SignPrivateKey_Set(Content);
 }
+
+//---------------------------------------------------------------------------
+void GUI_Preferences::OnC2PA_UserAnchors_BrowseClicked (bool)
+{
+    QString FileName = QFileDialog::getOpenFileName(this,
+                                                    tr("Open File..."),
+                                                    C2PA_UserAnchors_Path->text(),
+                                                    "Certificate files (*.pem *.crt *.cer);;All files (*.*)");
+
+    if (FileName.isEmpty())
+        return;
+
+    string Content;
+    if (!C2PA_ReadWholeFile(FileName.toUtf8().data(), Content))
+        return;
+
+    C2PA_UserAnchors_Path->setText(FileName);
+    Main->C2PA_UserAnchors_Set(Content);
+}
 #endif // defined(ENABLE_C2PA)
 
 //---------------------------------------------------------------------------
@@ -1352,6 +1395,12 @@ void GUI_Preferences::Create()
 
     C2PA_SignTA_URL_Edit=new QLineEdit();
 
+    //C2PA - User anchors (additional root certificates trusted when verifying signatures, e.g. a private/test CA)
+    C2PA_UserAnchors_Path=new QLineEdit();
+    C2PA_UserAnchors_Path->setReadOnly(true);
+    C2PA_UserAnchors_Browse=new QPushButton(QCommonStyle().standardIcon(QStyle::SP_FileIcon), "Browse...");
+    connect(C2PA_UserAnchors_Browse, SIGNAL(clicked(bool)), this, SLOT(OnC2PA_UserAnchors_BrowseClicked(bool)));
+
     QGridLayout* C2PA_SignCredentials_Layout=new QGridLayout();
     C2PA_SignCredentials_Layout->addWidget(new QLabel("Certificate file:"), 0, 0);
     C2PA_SignCredentials_Layout->addWidget(C2PA_SignCertificate_Path, 0, 1);
@@ -1363,6 +1412,9 @@ void GUI_Preferences::Create()
     C2PA_SignCredentials_Layout->addWidget(C2PA_SignAlgorithm_Combo, 2, 1);
     C2PA_SignCredentials_Layout->addWidget(new QLabel("Timestamp authority URL (optional):"), 3, 0);
     C2PA_SignCredentials_Layout->addWidget(C2PA_SignTA_URL_Edit, 3, 1);
+    C2PA_SignCredentials_Layout->addWidget(new QLabel("User anchors file (optional, for verification):"), 4, 0);
+    C2PA_SignCredentials_Layout->addWidget(C2PA_UserAnchors_Path, 4, 1);
+    C2PA_SignCredentials_Layout->addWidget(C2PA_UserAnchors_Browse, 4, 2);
 
     QGroupBox* C2PA_SignCredentials=new QGroupBox("Signing certificate, private key and options");
     C2PA_SignCredentials->setLayout(C2PA_SignCredentials_Layout);
@@ -1380,6 +1432,7 @@ void GUI_Preferences::Create()
         C2PA_SignPrivateKey_Browse->setToolTip(Tip);
         C2PA_SignAlgorithm_Combo->setToolTip(Tip);
         C2PA_SignTA_URL_Edit->setToolTip(Tip);
+        C2PA_UserAnchors_Browse->setToolTip(Tip);
     }
     #endif // defined(C2PA_DYNAMIC_LOADING)
     #endif // defined(ENABLE_C2PA)
@@ -1456,5 +1509,7 @@ void GUI_Preferences::LoadOriginalConfig()
     Main->C2PA_SignAlgorithm_Set(C2PA_SignAlgorithm_Combo->currentData().toString().toStdString());
     C2PA_SignTA_URL_Edit->setText(QString());
     Main->C2PA_SignTA_URL_Set(string());
+    C2PA_UserAnchors_Path->setText(QString());
+    Main->C2PA_UserAnchors_Set(string());
     #endif // defined(ENABLE_C2PA)
 }

Source/GUI/Qt/GUI_Preferences.h

@@ -225,6 +225,7 @@ class GUI_Preferences : public QDialog
     #if defined(ENABLE_C2PA)
     void OnC2PA_SignCertificate_BrowseClicked(bool Checked);
     void OnC2PA_SignPrivateKey_BrowseClicked(bool Checked);
+    void OnC2PA_UserAnchors_BrowseClicked(bool Checked);
     #endif // defined(ENABLE_C2PA)
 
 private:
@@ -266,6 +267,8 @@ class GUI_Preferences : public QDialog
     QPushButton*    C2PA_SignPrivateKey_Browse;
     QComboBox*      C2PA_SignAlgorithm_Combo;
     QLineEdit*      C2PA_SignTA_URL_Edit;
+    QLineEdit*      C2PA_UserAnchors_Path;
+    QPushButton*    C2PA_UserAnchors_Browse;
     #endif // defined(ENABLE_C2PA)
 };