Repository navigation
SPEC-007: make the AC5 test reach the timestamp authority - #184
Merged
Merged
Conversation
The test sent `extra_assertions: []`, a claim-v2 manifest without an actions assertion. c2pa-rs 0.91 verifies after signing (#2277) and refuses that manifest itself, so on c2pa-node 0.9.10 the test passed while the service signed every valid manifest without a timestamp and without contacting the TSA (contentauth/c2pa-js#244). It now sends a valid AI-generated marking, and asserts that the audit record's reason names the TSA URL the container was started with. Measured with CONTENTAUTH_TSA_URL=http://127.0.0.1:9/tsa: - c2pa-node 0.9.10: red, "a signature was produced without a timestamp". - c2pa-node 0.9.5 (main): green; reason "an error occurred from the underlying http resolver: error sending request for url (http://127.0.0.1:9/tsa)".
Maurice1969DB
added a commit
that referenced
this pull request
Oct 20, 2026
… its timestamp (#185) Records the 0.9.10 bump attempt. The Context migration and SPEC-014 Amendment 1 are measured green, and specVersion signs and reads back. The bump is held because c2pa-node 0.9.8 and later sign without an RFC 3161 timestamp on the CallbackSigner/signAsync path, even against an unreachable TSA (contentauth/c2pa-js#244). Also recorded: verify after sign in c2pa-rs 0.91 and the SPEC-007 AC5 test it fooled (fixed in #184), and a stray test server on port 3999.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SPEC-007 AC5 test (
TimestampFailsClosedTest) sentextra_assertions: []. That is a claim-v2 manifest without an actions assertion. c2pa-rs 0.91 verifies after signing (#2277) and refuses such a manifest itself. On c2pa-node 0.9.10 the test therefore passed for the wrong reason: the service signed every valid manifest without a timestamp and without contacting the TSA (contentauth/c2pa-js#244).The test now sends a valid AI-generated marking. It also asserts that the audit record's
reasonnames the TSA URL the container was started with, read from the container's environment.Measured with
CONTENTAUTH_TSA_URL=http://127.0.0.1:9/tsaandCC_TSA_EXPECT_UNREACHABLE=1:main)an error occurred from the underlying http resolver: error sending request for url (http://127.0.0.1:9/tsa)Only the test changes. Nothing in
src/orservice/, nothing in the dist.composer check: 519 passed, 7 skipped.bin/spec-check.php: 0 errors, 0 unresolved.