Add new module for C2PA manifest parsing and live streaming verification

[N1Knight]

Summary

This is a proposal to add a new module — @svta/cml-c2pa — for C2PA (Coalition for Content Provenance and Authenticity) support in web video players.

The C2PA Live Video Streaming specification (§19) defines two methods for per-segment provenance verification:

• VSI/EMSG method (§19.4) — uses a VSI (Verifiable Segment Info) map, a CBOR-encoded structure embedded in each media segment that carries the cryptographic hash and signature metadata. The COSE signature is delivered via an EMSG (Event Message Box), a BMFF box that transports in-band events within media segments.
• Per-segment C2PA Manifest Box method (§19.3) — embeds a full C2PA manifest box directly in each media segment, allowing self-contained provenance verification without relying on an init segment manifest.

The module would provide high-level validation entry points for init segments, media segments, and manifest-box segments, plus the lower-level decoders and hash utilities they build on.

We have already implemented this as part of a separate project and would like to contribute it to CML. Below is the scope and structure we have in mind — we'd love to hear your thoughts before opening a PR.

Why we believe C2PA belongs in CML

CML already implements a wide range of media specifications: ISO BMFF, CMCD, CMSD, DASH, ID3, WebVTT, DRM, and others. C2PA fits naturally into this ecosystem:

1. It is an industry-backed open standard. C2PA is an open technical specification published by the Coalition for Content Provenance and Authenticity (spec.c2pa.org), backed by Adobe, Microsoft, Google, Meta, OpenAI, and others.
2. It lives inside BMFF containers. C2PA manifests are embedded as UUID boxes (JUMBF per ISO 19566-5) inside MP4/ISOBMFF files — the same containers that @svta/cml-iso-bmff already parses.
3. It is an emerging specification worth early adoption. The C2PA Live Video Streaming specification (§19) was published in late 2025 and defines per-segment provenance verification via the VSI/EMSG method (§19.4) and the Per-segment C2PA Manifest Box method (§19.3). We are among the first to implement it in a web player context, and contributing it to CML would give the broader community a solid foundation to build on as adoption grows.
4. No existing module in CML or npm covers this. There is no @svta/cml-c2pa equivalent in the ecosystem today.
5. Aligns with SVTA's mission. SVTA's goal is to build shared infrastructure for video streaming. Content provenance is becoming a regulatory and commercial requirement for live news, sports, and UGC platforms.

Proposed scope

The module would provide three levels of API:

High-level validation (recommended entry points) — pure, stateless functions that encapsulate the full C2PA validation pipeline:

• Init segment validation — parse manifest, extract certificate, verify BMFF hash, validate session keys
• Media segment validation (VSI/EMSG) — COSE signature, BMFF hash, sequence number, key expiry
• Manifest-box segment validation — parse manifest, check chain, extract assertions

Mid-level decoders — for custom workflows:

• COSE_Sign1 decoding (RFC 9052)
• VSI map decoding from CBOR
• EMSG box parsing (ISO 14496-12)
• Manifest parsing from BMFF bytes

Utilities:

• Stateless sequence number tracking (duplicate, gap, out-of-order detection per C2PA §18.4)
• BMFF content hash computation and validation with XPath exclusions

Lower-level internals (JUMBF parsing, COSE signature verification, X.509 certificate parsing, COSE key conversion, signer binding verification) would not be part of the public API.

Proposed contribution strategy

We are planning to split the contribution into incremental PRs to make review easier. Below is the breakdown we have in mind — we are open to adjusting this if you prefer a different structure (e.g., a single PR with the full module):

PR	Description	Depends on
PR 1	Manifest parsing + COSE/X.509 verification	None
PR 2	EMSG/VSI decoding + per-segment manifest-box parsing + BMFF hashing + sequence tracking	PR 1
PR 3	High-level validators + public API + documentation	PR 2

Would this work for you, or would you prefer a different approach?

Dependencies

• @svta/cml-iso-bmff — used for BMFF box parsing (does not reimplement box reading)
• cbor-x — peer dependency for CBOR encoding/decoding (RFC 8949), already used by other CML packages

References

• C2PA Specification v2.3
• JUMBF — ISO 19566-5
• COSE — RFC 9052
• CBOR — RFC 8949

[littlespex]

This would be a welcome addition to CML. I'm not overly familiar with these specs myself. Would you or someone you know be willing to take on this work?

[N1Knight]

Thanks! Yes. We are already working on the implementation in our Qualabs fork (https://github.com/qualabs/common-media-library) and are committed to seeing it through. We'll proceed with the 3-PR breakdown proposed above. We'll keep this issue updated as we progress.