feat: verify generic ZIP containers

crates/encypher-c2pa/src/c2pa-core/spec.rs

@@ -446,6 +446,14 @@ pub static FORMAT_REGISTRY: &[FormatEntry] = &[
         versions: &[V2_4],
     }, // A.9 structured
     // ---- v2.4 additions: packaged documents (ZIP family) + fonts ----
+    FormatEntry {
+        mime: "application/zip",
+        versions: &[V2_4],
+    },
+    FormatEntry {
+        mime: "application/x-zip-based",
+        versions: &[V2_4],
+    },
     FormatEntry {
         mime: "application/epub+zip",
         versions: &[V2_4],
@@ -669,6 +677,8 @@ mod tests {
             "audio/flac",
             "font/otf",
             "application/epub+zip",
+            "application/zip",
+            "application/x-zip-based",
             "video/x-m4v",
         ] {
             assert!(

crates/encypher-c2pa/src/c2pa-formats/lib.rs

@@ -185,7 +185,9 @@ impl AssetFormat {
             "audio/flac" => Self::Flac,
             "audio/ogg" => Self::Ogg,
             "application/pdf" => Self::Pdf,
-            "application/epub+zip"
+            "application/zip"
+            | "application/x-zip-based"
+            | "application/epub+zip"
             | "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
             | "application/vnd.openxmlformats-officedocument.wordprocessingml.template"
             | "application/vnd.ms-word.document.macroenabled.12"
@@ -805,6 +807,8 @@ mod tests {
             ("audio/flac", AssetFormat::Flac),
             ("audio/ogg", AssetFormat::Ogg),
             ("application/pdf", AssetFormat::Pdf),
+            ("application/zip", AssetFormat::Zip),
+            ("application/x-zip-based", AssetFormat::Zip),
             ("application/epub+zip", AssetFormat::Zip),
             (
                 "application/vnd.openxmlformats-officedocument.wordprocessingml.document",

crates/encypher-c2pa/src/lib.rs

@@ -1218,6 +1218,8 @@ pub const SUPPORTED_EXTENSIONS: &[(&str, &str)] = &[
     ("ogg", "audio/ogg"),
     ("oga", "audio/ogg"),
     ("pdf", "application/pdf"),
+    ("zip", "application/zip"),
+    ("sketch", "application/zip"),
     ("epub", "application/epub+zip"),
     (
         "docx",
@@ -1608,6 +1610,14 @@ mod tests {
             mime_from_path(Path::new("data.tsv")),
             Some("text/tab-separated-values")
         );
+        assert_eq!(
+            mime_from_path(Path::new("archive.ZIP")),
+            Some("application/zip")
+        );
+        assert_eq!(
+            mime_from_path(Path::new("design.sketch")),
+            Some("application/zip")
+        );
     }
 
     /// A supported format with no extension can only be verified by passing
@@ -1621,6 +1631,7 @@ mod tests {
             "application/mp4",
             "video/x-m4v",
             "text/xml",
+            "application/x-zip-based",
         ];
         let unreachable: Vec<_> = supported_mime_types()
             .into_iter()
@@ -1664,12 +1675,14 @@ mod tests {
     #[test]
     fn format_list_is_sorted_and_contains_composition_formats() {
         let formats = supported_mime_types();
-        assert_eq!(formats.len(), 71);
+        assert_eq!(formats.len(), 73);
         assert!(formats.windows(2).all(|pair| pair[0] < pair[1]));
         assert!(formats.contains(&"video/mp4"));
         assert!(formats.contains(&"image/jpeg"));
         assert!(formats.contains(&"text/tab-separated-values"));
         assert!(formats.contains(&"application/vnd.oasis.opendocument.graphics"));
+        assert!(formats.contains(&"application/zip"));
+        assert!(formats.contains(&"application/x-zip-based"));
     }
 
     #[test]

crates/encypher-c2pa/tests/generic_zip.rs

@@ -0,0 +1,44 @@
+// Copyright 2026 Encypher Corporation
+// SPDX-License-Identifier: Apache-2.0
+
+use std::{fs, path::PathBuf};
+
+use encypher_c2pa::{supported_mime_types, verify};
+
+const ZIP_MIMES: [&str; 2] = ["application/zip", "application/x-zip-based"];
+
+fn fixture(name: &str) -> Vec<u8> {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../tests/fixtures")
+        .join(name);
+    fs::read(path).expect("generic ZIP fixture must be readable")
+}
+
+#[test]
+fn generic_zip_mimes_verify_collection_hash_match_and_mismatch() {
+    let signed = fixture("signed_generic.zip");
+    let tampered = fixture("tampered_signed_generic.zip");
+
+    for mime in ZIP_MIMES {
+        let valid = verify(&signed, mime).expect("signed generic ZIP must produce a report");
+        assert_eq!(valid.integrity, "valid", "{mime}");
+        assert_eq!(valid.signature, "valid", "{mime}");
+        assert_eq!(valid.hard_binding, "match", "{mime}");
+
+        let invalid = verify(&tampered, mime).expect("tampered generic ZIP must produce a report");
+        assert_eq!(invalid.integrity, "invalid", "{mime}");
+        assert_eq!(invalid.signature, "valid", "{mime}");
+        assert_eq!(invalid.hard_binding, "mismatch", "{mime}");
+    }
+}
+
+#[test]
+fn generic_zip_mimes_are_discoverable() {
+    let supported = supported_mime_types();
+    for mime in ZIP_MIMES {
+        assert!(
+            supported.contains(&mime),
+            "supported MIME list omits {mime}"
+        );
+    }
+}

scripts/test-wasm.mjs

@@ -166,6 +166,18 @@ assert.throws(
 assert.ok(supportedMimeTypes().includes("video/mp4"));
 assert.ok(supportedMimeTypes().includes("text/tab-separated-values"));
 assert.ok(supportedMimeTypes().includes("application/vnd.oasis.opendocument.graphics"));
+assert.ok(supportedMimeTypes().includes("application/zip"));
+assert.ok(supportedMimeTypes().includes("application/x-zip-based"));
+const signedZip = await readFile(resolve(root, "tests/fixtures/signed_generic.zip"));
+const tamperedZip = await readFile(resolve(root, "tests/fixtures/tampered_signed_generic.zip"));
+for (const mime of ["application/zip", "application/x-zip-based"]) {
+  const zipReport = verify(signedZip, mime);
+  assert.equal(zipReport.integrity, "valid", mime);
+  assert.equal(zipReport.hard_binding, "match", mime);
+  const tamperedZipReport = verify(tamperedZip, mime);
+  assert.equal(tamperedZipReport.integrity, "invalid", mime);
+  assert.equal(tamperedZipReport.hard_binding, "mismatch", mime);
+}
 const mp4 = await readFile(resolve(root, "tests/fixtures/signed_test.mp4"));
 const fragmented = verifyFragmented(mp4, [], "video/mp4");
 assert.equal(fragmented.integrity, "valid");

tests/fixtures/README.md

@@ -3,6 +3,8 @@
 - `signed_test.jpg`: Encypher-generated JPEG with an embedded C2PA 2.2 claim.
 - `signed_test.mp4`: Encypher-generated MP4 with an embedded C2PA 2.2 claim.
 - `signed_test.c2pa`: the C2PA Manifest Store of `signed_test.jpg`, extracted verbatim and kept beside it as an external (sidecar) manifest. It binds to `signed_test.jpg` and to nothing else.
+- `signed_generic.zip`: Encypher-generated generic ZIP with a C2PA 2.4 `c2pa.hash.collection.data` binding.
+- `tampered_signed_generic.zip`: the same signed ZIP with its bound `a.txt` member changed after signing. Verification must report a collection-hash mismatch.
 
 These fixtures are synthetic, contain no customer data, and are distributed under this repository's Apache-2.0 license. Their signing certificates are test credentials and are not trusted production identities.