# C2PA Web SDK bundle

This directory contains a browser bundle of the official Content Authenticity Initiative SDK. It is loaded only after a user starts a C2PA scan. Files are served by this site; there is no runtime CDN request.

## Pinned source packages

- `@contentauth/c2pa-web` 0.15.5, MIT: https://www.npmjs.com/package/@contentauth/c2pa-web/v/0.15.5
  - Source: https://github.com/contentauth/c2pa-js/tree/v0.15.5
  - npm tarball SHA-512 (base64): `8xNrpb/+Wo/6BsK/TpBmhm9H0oP/3BpQBFJblpwB87y6hRf9oxfuiDDFrOrfQlMSpemkR7cIQg/mmfYfx1JfkA==`
- `@contentauth/c2pa-wasm` 0.13.4, MIT: https://www.npmjs.com/package/@contentauth/c2pa-wasm/v/0.13.4
  - Its `pkg/c2pa_bg.wasm` matches the WASM published in c2pa-web 0.15.5 byte-for-byte.
  - npm tarball SHA-512 (base64): `5phokb41zgnT+doDfB4K1oddwJtzJaZ2FoTE6OjNGTHDKA8uQRLUwMs7fJv3nYj21rTbZQ3qaOkhpNdHkrORlQ==`
- `highgain` 0.1.0, ISC: https://www.npmjs.com/package/highgain/v/0.1.0
  - npm tarball SHA-512 (base64): `Vw/g2upw4MYLZ9e95k79+idMoPFEKvTQVTce9LCDfI+T6AiG+SdiR4WDKszB1grQy0O+uhxd6cqbdi3VhECdbA==`
- The upstream c2pa-web bundle includes its declared `@contentauth/c2pa-types` 0.7.7 and `@contentauth/c2pa-utilities` 0.3.3 dependencies. Their MIT terms are covered by the upstream notices; they are not distributed as separate runtime files.

## Included runtime files

- `index.js`, `c2pa-DX8BGA0J.js`, and `c2pa_worker.js` come from the c2pa-web 0.15.5 npm tarball. The chunk's bare `highgain` import was changed to the relative same-origin path `./highgain.js` so the official ESM bundle resolves without a CDN or import-map dependency.
- `c2pa_bg.wasm` comes from c2pa-web 0.15.5 (the package's generated resource from c2pa-wasm 0.13.4).
- `highgain.js` comes from highgain 0.1.0.
- `LICENSE` contains the upstream MIT terms for c2pa-web/c2pa-wasm; `LICENSE-ISC` contains the highgain ISC terms.

The adapter sets `verifyTrust: false`. This site has no configured trust roots, so it displays SDK validation status but always reports `trusted: false`. Signature or claim validation results do not establish the real-world truth of a claim or the identity of its author.

## Verification sample sources

Browser smoke tests used the public C2PA conformance samples `adobe-20220124-C.jpg` and `adobe-20220124-E-sig-CA.jpg` from https://github.com/c2pa-org/public-testfiles/tree/main/legacy/1.4/image/jpeg . The sample repository is CC BY-SA; those files were kept outside this repository and are not redistributed here.