Missing Validation Status

[hackerfactor]

c2patool 0.10.2: it no longer displays the "validation_status" block. For example (https://fotoforensics.com/analysis.php?id=9319b3d54148ccb21a6dd3947cfae4766f8ae4f4.394694&fmt=orig): c2patool 0.7.0 through 0.9.10 with -d includes a "validation_status" summary, showing which claims and assertions are validated.

  "validation_status": [
    {
      "code": "claimSignature.validated",
      "url": "self#jumbf=/c2pa/urn:uuid:6e9825b9-c208-4d07-9727-fc99fc466d19/c2pa.signature",
      "explanation": "claim signature valid"
    },
    {
      "code": "assertion.hashedURI.match",
      "url": "self#jumbf=/c2pa/urn:uuid:6e9825b9-c208-4d07-9727-fc99fc466d19/c2pa.assertions/c2pa.thumbnail.ingredient.jpeg",
      "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.thumbnail.ingredient.jpeg"
    },
    {
      "code": "assertion.hashedURI.match",
      "url": "self#jumbf=/c2pa/urn:uuid:6e9825b9-c208-4d07-9727-fc99fc466d19/c2pa.assertions/c2pa.ingredient",
      "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.ingredient"
    },
    {
      "code": "assertion.hashedURI.match",
      "url": "self#jumbf=/c2pa/urn:uuid:6e9825b9-c208-4d07-9727-fc99fc466d19/c2pa.assertions/c2pa.hash.data",
      "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data"
    },
    {
      "code": "assertion.dataHash.match",
      "url": "self#jumbf=/c2pa/urn:uuid:6e9825b9-c208-4d07-9727-fc99fc466d19/c2pa.assertions/c2pa.hash.data",
      "explanation": "data hash valid"
    },
    {
      "code": "claimSignature.validated",
      "url": "self#jumbf=/c2pa/urn:uuid:7b02591b-8d92-4381-8759-d585dcf5df55/c2pa.signature",
      "explanation": "claim signature valid"
    },
    {
      "code": "assertion.hashedURI.match",
      "url": "self#jumbf=/c2pa/urn:uuid:7b02591b-8d92-4381-8759-d585dcf5df55/c2pa.assertions/c2pa.actions",
      "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.actions"
    },
    {
      "code": "assertion.hashedURI.match",
      "url": "self#jumbf=/c2pa/urn:uuid:7b02591b-8d92-4381-8759-d585dcf5df55/c2pa.assertions/c2pa.hash.data",
      "explanation": "hashed uri matched: self#jumbf=c2pa.assertions/c2pa.hash.data"
    }
  ]

But 0.10.x omits this validation_status information, so the caller cannot determine if the file is actually valid.

[github-jira-sync-bot]

Unfortunately, not enough information was provided to create a Jira ticket. Please make sure you added the following label(s): accepted

Once all required labels are present, please add bug label again.

[github-jira-sync-bot]

✅ Jira issue https://jira.corp.adobe.com/browse/CAI-7462 is successfully created for this GitHub issue.

[gpeacock]

This was lost as part of the transition to the new Reader API. It will be restored in a new and better format as validation_results with the addition of claims v2 support.
FYI, in the non-debug format, validation_status only shows up if there are errors, so the lack of validation_status means that the manifest was successfully validated.

[hackerfactor]

validation_status only shows up if there are errors, so the lack of validation_status means that the manifest was successfully validated

The problem is, without validation_status, c2patool does not identify what was evaluation. We only know that the unknown elements that were evaluated appear to be valid.

The validation_status block is essential because it identifies what was evaluated as well as the evaluation results.

[gpeacock]

The new version of c2patool (0.13.1) now includes validation_results in the detailed report. The validation_results filed is a more structured version of status reporting matching the c2pa 2.1 specification. It separates the active_manifest status codes and any delta changes from each ingredient. The codes are further divided into success, informational and failure.
We use this format to report both v1 and v2 claims, since both may be in any manifest store.
validation_status will still be available in the regular report and in ingredients, but only reports errors in those cases.

[hackerfactor]

Confirmed: 0.13.1 with -d displays the validation status.

You changed the output format, splitting out success, informational, and failure. Probably a good idea, but it was an unexpected code change that will require a rewrite on my code that was looking for the previous format.