None image passes the verification if signed with older c2patool - "This file may have been tampered with. Its Content Credentials can’t be verified or viewed."

[smartframe-backend-team]

We have millions of images signed with c2patool 0.18.4 or older. Recently, those images fail to pass the verification on https://contentcredentials.org/verify.

The last time I checked the images, and the verification worked for them, was September 2nd, so I guess some release after that date is to blame for the issue

When we check the image with c2patool 0.23.2 we get the following:

{ "active_manifest": "urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe", "manifests": { "urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe": { "claim_generator_info": [ { "name": "SmartFrame Image Cloud", "version": "1.0.0", "icon": { "format": "image/svg+xml", "identifier": "self#jumbf=-c2pa-urn-c2pa-5466650a-e07b-463b-a09a-b990a151a2b2-smartframe-c2pa.databoxes-c2pa.data" }, "org.cai.c2pa_rs": "0.55.0" } ], "title": "ip206088-sf.jpeg", "instance_id": "xmp:iid:a377f9d2-7b6d-4f6f-884b-530ecc2fdd7e", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, "ingredients": [ { "title": "ip206088.jpeg", "format": "image/jpeg", "instance_id": "xmp.iid:2698e479-7488-498c-9223-ae272fc19291", "thumbnail": { "format": "image/jpeg", "identifier": "self#jumbf=c2pa.assertions/c2pa.thumbnail.ingredient.jpeg" }, "relationship": "parentOf", "label": "c2pa.ingredient.v3" } ], "assertions": [ { "label": "c2pa.actions.v2", "data": { "actions": [ { "action": "c2pa.opened", "parameters": { "description": "Opened a pre-existing file", "com.adobe.icon": "https://cai-assertions.adobe.com/icons/import-dark.svg" } }, { "action": "smartframe.conversion", "parameters": { "description": "This image has been converted into a SmartFrame", "com.adobe.icon": "https://assets.smartframe.io/smartframe_icon.svg" } } ], "metadata": { "dateTime": "2023-03-14T09:41:00.176Z", "localizations": [ { "actions[0].action": { "en-US": "Opened" } }, { "actions[0].description": { "en-US": "Opened a pre-existing file" } }, { "actions[1].action": { "en-US": "SmartFrame conversion" } }, { "actions[1].description": { "en-US": "This image has been converted into a SmartFrame" } } ] } } }, { "label": "stds.schema-org.CreativeWork", "data": { "@context": "https://schema.org", "@type": "CreativeWork", "author": [ { "@id": "https://www.facebook.com/SmartFrame/", "name": "SmartFrame", "@type": "Person" }, { "@id": "https://www.instagram.com/smartframe_technologies/", "name": "SmartFrame", "@type": "Person" }, { "@id": "https://www.linkedin.com/company/smartframe-technologies/", "name": "SmartFrame", "@type": "Person" }, { "@id": "https://x.com/SmartFrame", "name": "SmartFrame", "@type": "Person" } ] }, "kind": "Json" } ], "signature_info": { "alg": "Es256", "issuer": "SmartFrame Technologies Ltd", "common_name": "SmartFrame Technologies Ltd", "cert_serial_number": "488761971274233465403683788408333525933889433675", "time": "2025-10-05T14:30:56+00:00" }, "label": "urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe" } }, "validation_status": [ { "code": "assertion.action.ingredientMismatch", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.actions", "explanation": "opened, placed and removed items must have ingredient(s) parameters" } ], "validation_results": { "activeManifest": { "success": [ { "code": "timeStamp.validated", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.signature", "explanation": "timestamp message digest matched: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1" }, { "code": "claimSignature.insideValidity", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "claimSignature.validated", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.signature", "explanation": "claim signature valid" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.thumbnail.claim.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.claim.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.thumbnail.ingredient.jpeg", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.ingredient.jpeg" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.ingredient.v3", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ingredient.v3" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.actions", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data" }, { "code": "assertion.hashedURI.match", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/stds.schema-org.CreativeWork", "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/stds.schema-org.CreativeWork" }, { "code": "assertion.dataHash.match", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.hash.data", "explanation": "data hash valid" } ], "informational": [ { "code": "timeStamp.untrusted", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.signature", "explanation": "timestamp cert untrusted: DigiCert SHA256 RSA4096 Timestamp Responder 2025 1" } ], "failure": [ { "code": "assertion.action.ingredientMismatch", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.actions", "explanation": "opened, placed and removed items must have ingredient(s) parameters" } ] }, "ingredientDeltas": [ { "ingredientAssertionURI": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.ingredient.v3", "validationDeltas": { "success": [], "informational": [ { "code": "ingredient.unknownProvenance", "url": "self#jumbf=/c2pa/urn:c2pa:5466650a-e07b-463b-a09a-b990a151a2b2:smartframe/c2pa.assertions/c2pa.ingredient.v3", "explanation": "ip206088.jpeg: ingredient does not have provenance" } ], "failure": [] } } ] }, "validation_state": "Invalid" }

Here are examples of images that do not pass the verification.

https://contentcredentials.org/verify?tour=1&source=https%3A%2F%2Fiy-sp1-qa.smartframe.io%2Fp%2Fxkjm2loa8M9X%2Fc2paVerificationFile
https://contentcredentials.org/verify?tour=1&source=https%3A%2F%2Fmancity.smartframe.io%2Fp%2FmcfcDw96bXIy%2Fc2paVerificationFile