C2PAVerifier Component

Properties   Methods   Events   Config Settings   Errors  

Extracts and validates the C2PA Manifests embedded in an asset.

Syntax

nsoftware.IPWorksLLM.C2PAVerifier

Remarks

The C2PAVerifier component reads the Content Credentials embedded in an asset and reports what can be established about them: whether the signature is intact, whether the signer is trusted, and whether the asset bytes still match what was signed.

Supported Formats

JPEG, PNG and PDF are supported. The format is detected from the asset itself, and an asset in any other format is refused rather than reported as carrying no provenance, since those are different answers.

The PDF reader locates the manifest by its file specification's AFRelationship, so it reads manifests written by any conforming tool, not only those this product produced.

Validating an Asset

Set InputFile to the asset and call Verify. Every manifest found is then added to the Manifests collection, and one entry per check performed is added to ValidationResults.

C2PAVerifier verifier = new C2PAVerifier(); verifier.InputFile = "photo-signed.jpg"; verifier.Verify(); foreach (C2PAValidationResult result in verifier.ValidationResults) Console.WriteLine(result.Severity + " " + result.Code + ": " + result.Explanation);

Reading the Results

Validation is not a single boolean. The C2PA specification defines a status code for each individual check, and the component reports them verbatim so an application can decide how much weight to give each one. A signature that verifies but whose signer is not on a trust list is a different situation from one whose content binding fails.

Each entry in ValidationResults carries a Severity of success, informational, or failure. Codes such as claimSignature.validated and assertion.dataHash.match are successes; assertion.dataHash.mismatch means the asset was altered after signing; signingCredential.untrusted means the signature is intact but the signer does not chain to any configured trust anchor.

The ValidationStatus event fires once for each result as it is produced, which is convenient when validation should be reported incrementally rather than inspected afterwards.

The Provenance Chain

An asset may carry more than one manifest: the active manifest describes the most recent edit, and earlier manifests describe the ingredients it was built from. All of them appear in Manifests, with ActiveManifestIndex identifying the active one.

verifier.Verify(); C2PAManifest active = verifier.Manifests[verifier.ActiveManifestIndex]; Console.WriteLine("Produced by " + active.ClaimGenerator + ", signed by " + active.SignerSubject);

Trust Anchors

By default the component validates signing certificates against the built-in C2PA trust list. Additional anchors are supplied through the TrustedCerts collection, and are used in addition to the built-in list rather than instead of it, as the C2PA specification prescribes. Setting UseC2PATrustList to False restricts validation to the supplied anchors alone, which is the correct configuration for a private PKI.

Setting CheckRevocation to True additionally performs online revocation checking. Revocation information stapled into the manifest by the signer is always used when present, whether or not online checking is enabled.

Property List


The following is the full list of the properties of the component with short descriptions. Click on the links for further details.

ActiveManifestIndex The index of the active manifest in the Manifests collection.
CheckRevocation Whether online revocation checking is performed.
Ingredients The ingredients the active Manifest declares.
InputData The asset to process, held in memory.
InputFile The asset to process.
Manifests The C2PA Manifests found in the asset.
TrustedCerts Additional trust anchors used to validate signing certificates.
UseC2PATrustList Whether the built-in C2PA trust list is used.
ValidationResults The outcome of each validation check performed.

Method List


The following is the full list of the methods of the component with short descriptions. Click on the links for further details.

Config Sets or retrieves a configuration setting.
Reset This method will reset the component.
Verify Extracts and validates the C2PA Manifests in the asset.

Event List


The following is the full list of the events fired by the component with short descriptions. Click on the links for further details.

Error Fired when information is available about errors during data delivery.
Log This event fires once for each log message.
ManifestFound Fires once for each C2PA Manifest found in the asset.
ValidationStatus Fires once for each validation status code produced.

Config Settings


The following is a list of config settings for the component with short descriptions. Click on the links for further details.

AcceptedEKUs The extended key usages accepted from a claim signer.
LogLevel The level of detail logged through the Log event.
TrustListDate The date the built-in C2PA trust list was captured.
TrustListVersion The version of the built-in C2PA trust list.
ValidateIngredients Whether ingredient manifests are validated as well as the active one.
BuildInfo Information about the product's build.
GUIAvailable Whether or not a message loop is available for processing events.
LicenseInfo Information about the current license.
MaskSensitiveData Whether sensitive data is masked in log messages.
UseInternalSecurityAPI Whether or not to use the system security libraries or an internal implementation.

ActiveManifestIndex Property (C2PAVerifier Component)

The index of the active manifest in the Manifests collection.

Syntax

public int ActiveManifestIndex { get; }
                
Public ReadOnly Property ActiveManifestIndex As Integer
                

Default Value

-1

Remarks

This property identifies which item in Manifests is the active manifest, the one describing how the asset reached its current state. The C2PA specification fixes the active manifest as the last one in the manifest store.

The value is -1 when no manifest was found.

This property is read-only and not available at design time.

CheckRevocation Property (C2PAVerifier Component)

Whether online revocation checking is performed.

Syntax

public bool CheckRevocation { get; set; }
                
Public Property CheckRevocation As Boolean
                

Default Value

False

Remarks

This property controls whether the component contacts OCSP responders or downloads CRLs to determine whether the signing certificate has been revoked.

Revocation information stapled into the manifest by the signer is always used when present, whether or not this property is set. Setting it to True additionally performs an online check, which requires network access and makes verification slower.

When revocation cannot be determined, verification does not fail; an informational result such as signingCredential.ocsp.inaccessible or signingCredential.ocsp.skipped is reported so the application can decide what that is worth.

The default value is False.

This property is not available at design time.

Ingredients Property (C2PAVerifier Component)

The ingredients the active Manifest declares.

Syntax

public C2PAIngredientList Ingredients { get; }
                
Public Property Ingredients As C2PAIngredientList
                

Remarks

Each entry is an asset that went into the one being verified, together with the relationship between them. This is how an application follows provenance backwards: what this content was made from, and what that in turn came from.

The collection is empty for content that was captured rather than assembled, which is the ordinary case for a photograph straight out of a camera.

ManifestLabel names the ingredient's own Manifest when the producer embedded it. That Manifest appears in Manifests alongside the active one, so the chain can be walked without the original source asset. When ManifestLabel is empty, the producer recorded the source without embedding its Manifest and the chain stops there.

Example. Walking the provenance chain:

C2PAVerifier verifier = new C2PAVerifier(); verifier.InputFile = "edited-signed.jpg"; verifier.Verify(); Console.WriteLine("Signed by " + verifier.Manifests[verifier.ActiveManifestIndex].SignerSubject); for (int i = 0; i < verifier.Ingredients.Count; i++) { C2PAIngredient source = verifier.Ingredients[i]; Console.WriteLine(" " + source.Relationship + ": " + source.Title + " (" + source.Format + ")"); if (source.ManifestLabel.Length == 0) continue; // Its manifest travels in the same store; find who signed that one. for (int j = 0; j < verifier.Manifests.Count; j++) { if (verifier.Manifests[j].ManifestLabel == source.ManifestLabel) { Console.WriteLine(" originally signed by " + verifier.Manifests[j].SignerSubject); } } }

This property is not available at design time.

Please refer to the C2PAIngredient type for a complete list of fields.

InputData Property (C2PAVerifier Component)

The asset to process, held in memory.

Syntax

public string InputData { get; set; }
public byte[] InputDataB { get; set; }
                
Public Property InputData As String
Public Property InputDataB As Byte()
                

Default Value

""

Remarks

This property specifies the asset to be processed as a byte array, for applications that do not work with files on disk.

When both InputFile and this property are set, InputFile takes precedence.

InputFile Property (C2PAVerifier Component)

The asset to process.

Syntax

public string InputFile { get; set; }
                
Public Property InputFile As String
                

Default Value

""

Remarks

This property specifies the asset to be processed. Set it to the full or relative path of the file.

When both this property and InputData are set, this property takes precedence.

Manifests Property (C2PAVerifier Component)

The C2PA Manifests found in the asset.

Syntax

public C2PAManifestList Manifests { get; }
                
Public ReadOnly Property Manifests As C2PAManifestList
                

Remarks

This collection is populated by Verify with one C2PAManifest item for each manifest present in the asset.

An asset normally carries more than one: the active manifest describes the most recent edit, and the manifests before it describe the ingredients that edit was built from. Together they form the provenance chain. ActiveManifestIndex identifies the active one.

This property is read-only and not available at design time.

Please refer to the C2PAManifest type for a complete list of fields.

TrustedCerts Property (C2PAVerifier Component)

Additional trust anchors used to validate signing certificates.

Syntax

public CertificateList TrustedCerts { get; }
                
Public Property TrustedCerts As CertificateList
                

Remarks

This collection holds trust anchors supplied by the application. They are used in addition to the built-in C2PA trust list, not instead of it, which is what the C2PA specification prescribes for a validator.

Setting UseC2PATrustList to False restricts validation to the anchors in this collection alone. That is the correct configuration when validating assets signed under a private PKI, where the public C2PA trust list is irrelevant.

A signing certificate that chains to none of the active anchors produces a signingCredential.untrusted result. The signature itself may still be intact; the two conditions are reported separately so an application can tell them apart.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

UseC2PATrustList Property (C2PAVerifier Component)

Whether the built-in C2PA trust list is used.

Syntax

public bool UseC2PATrustList { get; set; }
                
Public Property UseC2PATrustList As Boolean
                

Default Value

True

Remarks

This property controls whether signing certificates are validated against the C2PA trust list built into the component, in addition to any anchors in TrustedCerts.

The default value is True, which is the configuration the C2PA specification describes for a validator: the trust anchors for the claim signing extended key usage include the C2PA trust list, and a user may configure further anchors on top of it.

Set this property to False to validate against TrustedCerts alone, which is appropriate for a private PKI where the public list has no bearing.

The built-in list is a snapshot taken when the component was built. Query the TrustListVersion and TrustListDate configuration settings to determine how current that snapshot is; supply newer anchors through TrustedCerts when it has aged.

This property is not available at design time.

ValidationResults Property (C2PAVerifier Component)

The outcome of each validation check performed.

Syntax

public C2PAValidationResultList ValidationResults { get; }
                
Public ReadOnly Property ValidationResults As C2PAValidationResultList
                

Remarks

This collection is populated by Verify with one C2PAValidationResult item per check.

Validation is deliberately not reduced to a single boolean. The C2PA specification defines a status code for each individual check, and the component reports those codes verbatim, because the situations behind them differ in kind. A signature that verifies but whose signer is unknown is a question about trust; a content binding that fails is evidence the asset was altered. An application should decide for itself how to weigh them.

Each item carries a Severity of success, informational, or failure. Verification does not throw when a check fails; the failure appears as a result so the whole picture is available at once.

This property is read-only and not available at design time.

Please refer to the C2PAValidationResult type for a complete list of fields.

Config Method (C2PAVerifier Component)

Sets or retrieves a configuration setting.

Syntax

public string Config(string configurationString);

Async Version
public async Task<string> Config(string configurationString);
public async Task<string> Config(string configurationString, CancellationToken cancellationToken);
                
Public Function Config(ByVal ConfigurationString As String) As String

Async Version
Public Function Config(ByVal ConfigurationString As String) As Task(Of String)
Public Function Config(ByVal ConfigurationString As String, cancellationToken As CancellationToken) As Task(Of String)
                

Remarks

Config is a generic method available in every component. It is used to set and retrieve configuration settings for the component.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

Reset Method (C2PAVerifier Component)

This method will reset the component.

Syntax

public void Reset();

Async Version
public async Task Reset();
public async Task Reset(CancellationToken cancellationToken);
                
Public Sub Reset()

Async Version
Public Sub Reset() As Task
Public Sub Reset(cancellationToken As CancellationToken) As Task
                

Remarks

This method will reset the component's properties to their default values.

Verify Method (C2PAVerifier Component)

Extracts and validates the C2PA Manifests in the asset.

Syntax

public void Verify();

Async Version
public async Task Verify();
public async Task Verify(CancellationToken cancellationToken);
                
Public Sub Verify()

Async Version
Public Sub Verify() As Task
Public Sub Verify(cancellationToken As CancellationToken) As Task
                

Remarks

This method reads the asset named by InputFile (or held in InputData), locates the C2PA Manifest Store, and validates it. Manifests and ValidationResults are populated when it returns.

For the active manifest, the component verifies the claim signature, builds a certificate path from the signing certificate to the active trust anchors, and recomputes the content binding hash over the asset to confirm the bytes still match what was signed.

C2PAVerifier verifier = new C2PAVerifier(); verifier.InputFile = "photo-signed.jpg"; verifier.Verify(); foreach (C2PAValidationResult result in verifier.ValidationResults) Console.WriteLine(result.Severity + " " + result.Code + ": " + result.Explanation);

A failed check does not throw. It is reported through ValidationResults and the ValidationStatus event, so that a partially trustworthy asset can be described accurately rather than merely rejected. An error is thrown only when the asset cannot be read at all, or carries no C2PA Manifest.

Error Event (C2PAVerifier Component)

Fired when information is available about errors during data delivery.

Syntax

public event OnErrorHandler OnError;

public delegate void OnErrorHandler(object sender, C2PAVerifierErrorEventArgs e);

public class C2PAVerifierErrorEventArgs : EventArgs {
  public int ErrorCode { get; }
  public string Description { get; }
}

Async Version
public event AsyncEventHandler<C2PAVerifierErrorEventArgs> OnError;

public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e);

public class C2PAVerifierErrorEventArgs : AsyncEventArgs {
  public CancellationToken CancellationToken { get; }
  public int ErrorCode { get; }
  public string Description { get; }
}
                
Public Event OnError As OnErrorHandler

Public Delegate Sub OnErrorHandler(sender As Object, e As C2PAVerifierErrorEventArgs)

Public Class C2PAVerifierErrorEventArgs Inherits EventArgs
  Public ReadOnly Property ErrorCode As Integer
  Public ReadOnly Property Description As String
End Class

Async Version
Public Event OnError As AsyncEventHandler(Of C2PAVerifierErrorEventArgs)

Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task

Public Class C2PAVerifierErrorEventArgs Inherits AsyncEventArgs
  Public ReadOnly Property CancellationToken As CancellationToken
  Public ReadOnly Property ErrorCode As Integer
  Public ReadOnly Property Description As String
End Class
                

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the component throws an exception.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

Log Event (C2PAVerifier Component)

This event fires once for each log message.

Syntax

public event OnLogHandler OnLog;

public delegate void OnLogHandler(object sender, C2PAVerifierLogEventArgs e);

public class C2PAVerifierLogEventArgs : EventArgs {
  public int LogLevel { get; }
  public string Message { get; }
  public string LogType { get; }
}

Async Version
public event AsyncEventHandler<C2PAVerifierLogEventArgs> OnLog;

public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e);

public class C2PAVerifierLogEventArgs : AsyncEventArgs {
  public CancellationToken CancellationToken { get; }
  public int LogLevel { get; }
  public string Message { get; }
  public string LogType { get; }
}
                
Public Event OnLog As OnLogHandler

Public Delegate Sub OnLogHandler(sender As Object, e As C2PAVerifierLogEventArgs)

Public Class C2PAVerifierLogEventArgs Inherits EventArgs
  Public ReadOnly Property LogLevel As Integer
  Public ReadOnly Property Message As String
  Public ReadOnly Property LogType As String
End Class

Async Version
Public Event OnLog As AsyncEventHandler(Of C2PAVerifierLogEventArgs)

Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task

Public Class C2PAVerifierLogEventArgs Inherits AsyncEventArgs
  Public ReadOnly Property CancellationToken As CancellationToken
  Public ReadOnly Property LogLevel As Integer
  Public ReadOnly Property Message As String
  Public ReadOnly Property LogType As String
End Class
                

Remarks

This event fires once for each log message generated by the component. The verbosity is controlled by the LogLevel setting.

LogLevel indicates the level of message. Possible values are as follows:

0 (None)No messages are logged.
1 (Info - default)Informational events such as the start and completion of a signing or verification operation are logged.
2 (Verbose)Detailed data such as individual manifest boxes and validation steps are logged.
3 (Debug)Debug data including byte offsets and hash inputs are logged.

Message is the log entry.

LogType identifies the type of log entry. Possible values are Info, Manifest, Signature, and Validation.

ManifestFound Event (C2PAVerifier Component)

Fires once for each C2PA Manifest found in the asset.

Syntax

public event OnManifestFoundHandler OnManifestFound;

public delegate void OnManifestFoundHandler(object sender, C2PAVerifierManifestFoundEventArgs e);

public class C2PAVerifierManifestFoundEventArgs : EventArgs {
  public string ManifestLabel { get; }
  public string ClaimGenerator { get; }
  public string SignerSubject { get; }
  public bool IsActive { get; }
}

Async Version
public event AsyncEventHandler<C2PAVerifierManifestFoundEventArgs> OnManifestFound;

public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e);

public class C2PAVerifierManifestFoundEventArgs : AsyncEventArgs {
  public CancellationToken CancellationToken { get; }
  public string ManifestLabel { get; }
  public string ClaimGenerator { get; }
  public string SignerSubject { get; }
  public bool IsActive { get; }
}
                
Public Event OnManifestFound As OnManifestFoundHandler

Public Delegate Sub OnManifestFoundHandler(sender As Object, e As C2PAVerifierManifestFoundEventArgs)

Public Class C2PAVerifierManifestFoundEventArgs Inherits EventArgs
  Public ReadOnly Property ManifestLabel As String
  Public ReadOnly Property ClaimGenerator As String
  Public ReadOnly Property SignerSubject As String
  Public ReadOnly Property IsActive As Boolean
End Class

Async Version
Public Event OnManifestFound As AsyncEventHandler(Of C2PAVerifierManifestFoundEventArgs)

Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task

Public Class C2PAVerifierManifestFoundEventArgs Inherits AsyncEventArgs
  Public ReadOnly Property CancellationToken As CancellationToken
  Public ReadOnly Property ManifestLabel As String
  Public ReadOnly Property ClaimGenerator As String
  Public ReadOnly Property SignerSubject As String
  Public ReadOnly Property IsActive As Boolean
End Class
                

Remarks

This event fires as each manifest is located, before validation of that manifest completes.

ManifestLabel is the manifest's identifier, a urn:c2pa value. ClaimGenerator names the tool that produced it. SignerSubject is the subject of the certificate that signed the claim. IsActive is True for the active manifest, which is the last one in the store.

The same information is available afterwards through the Manifests collection; this event is for applications that would rather report provenance as it is discovered.

ValidationStatus Event (C2PAVerifier Component)

Fires once for each validation status code produced.

Syntax

public event OnValidationStatusHandler OnValidationStatus;

public delegate void OnValidationStatusHandler(object sender, C2PAVerifierValidationStatusEventArgs e);

public class C2PAVerifierValidationStatusEventArgs : EventArgs {
  public string Code { get; }
  public string Explanation { get; }
  public int Severity { get; }
  public string ManifestLabel { get; }
}

Async Version
public event AsyncEventHandler<C2PAVerifierValidationStatusEventArgs> OnValidationStatus;

public delegate Task AsyncEventHandler<TEventArgs>(object sender, TEventArgs e);

public class C2PAVerifierValidationStatusEventArgs : AsyncEventArgs {
  public CancellationToken CancellationToken { get; }
  public string Code { get; }
  public string Explanation { get; }
  public int Severity { get; }
  public string ManifestLabel { get; }
}
                
Public Event OnValidationStatus As OnValidationStatusHandler

Public Delegate Sub OnValidationStatusHandler(sender As Object, e As C2PAVerifierValidationStatusEventArgs)

Public Class C2PAVerifierValidationStatusEventArgs Inherits EventArgs
  Public ReadOnly Property Code As String
  Public ReadOnly Property Explanation As String
  Public ReadOnly Property Severity As Integer
  Public ReadOnly Property ManifestLabel As String
End Class

Async Version
Public Event OnValidationStatus As AsyncEventHandler(Of C2PAVerifierValidationStatusEventArgs)

Public Delegate Function AsyncEventHandler(Of TEventArgs)(sender As Object, e As TEventArgs) As Task

Public Class C2PAVerifierValidationStatusEventArgs Inherits AsyncEventArgs
  Public ReadOnly Property CancellationToken As CancellationToken
  Public ReadOnly Property Code As String
  Public ReadOnly Property Explanation As String
  Public ReadOnly Property Severity As Integer
  Public ReadOnly Property ManifestLabel As String
End Class
                

Remarks

This event fires as each check completes, giving the same information that is appended to ValidationResults.

Code is the status code defined by the C2PA specification, reported verbatim. Common values are claimSignature.validated and assertion.dataHash.match on success, assertion.dataHash.mismatch when the asset was altered after signing, and signingCredential.untrusted when the signature is intact but the signer chains to no configured trust anchor.

Explanation is a human-readable description of the check.

Severity is 0 (success), 1 (informational), or 2 (failure).

ManifestLabel identifies which manifest the result applies to.

C2PAIngredient Type

An asset that went into the one being described.

Remarks

This type represents an ingredient: another asset that was used to produce this one, together with the relationship between them.

Ingredients are what turn individual manifests into a provenance chain. When an editor opens a photograph and places it into a composite, the composite's manifest records the photograph as an ingredient, carrying that photograph's own manifest with it. A consumer can then walk backwards through the chain to the original capture.

The following fields are available:

Fields

Format
string

Default: ""

The media type of the ingredient asset.

This field holds the media type of the asset that went into this one, for example image/jpeg, image/png or application/pdf. The component fills it in from the source asset when the ingredient is added.

InstanceId
string

Default: ""

The instance identifier of the ingredient asset.

This field holds the identifier of the exact version of the asset that went into this one, normally an XMP instance identifier such as xmp:iid:....

When the ingredient carried a C2PA Manifest of its own, the component fills this in from that Manifest's claim, so the reference names the precise version that was used rather than the document in general.

Version 2 of the ingredient assertion also carried a document identifier. Version 3, which this component writes, removed it, so there is no corresponding field.

ManifestLabel
string

Default: ""

The label of the ingredient's own C2PA Manifest.

This field identifies the manifest that describes the ingredient, when the ingredient carried one. It is the urn:c2pa label of that manifest within the same manifest store.

An empty value means the ingredient arrived without provenance data of its own.

Relationship
string

Default: "componentOf"

How the ingredient relates to the asset.

This field describes the ingredient's role. The C2PA specification defines the following values:

parentOfThe asset is a derivative of this ingredient. There is at most one parent.
componentOfThe ingredient was placed into the asset alongside other content.
inputToThe ingredient was consumed as input, for example as a prompt or a training input, without appearing in the result.

The default value is componentOf.

Title
string

Default: ""

A human-readable name for the ingredient.

This field holds a title for the ingredient asset, typically its filename, so a consumer can present the provenance chain in terms a person recognises.

Constructors

public C2PAIngredient();
                
Public C2PAIngredient()
                

C2PAManifest Type

One C2PA Manifest found in an asset.

Remarks

This type describes a single manifest recovered by Verify: what claimed to produce the asset at that point in its history, and who signed that claim.

An asset's manifests together form its provenance chain. The last one in the store is the active manifest, describing the most recent edit; the ones before it came along with the ingredients that edit consumed.

The following fields are available:

Fields

ClaimGenerator
string (read-only)

Default: ""

The tool that produced this manifest.

This field names the application that created the claim, as recorded by its signer.

It is a claim, not a verified fact: it says what the signer wrote down. What the signature establishes is who wrote it, which is SignerSubject.

IsActive
bool (read-only)

Default: false

Whether this is the active manifest.

This field is True for the manifest that describes how the asset reached its current state, and False for the manifests that came with its ingredients.

The C2PA specification fixes the active manifest as the last one in the manifest store.

ManifestLabel
string (read-only)

Default: ""

The manifest's identifier.

This field holds the manifest's label, a urn:c2pa value that uniquely identifies it within the manifest store. Ingredients refer to their manifests by this value.

SignerSubject
string (read-only)

Default: ""

The subject of the certificate that signed the claim.

This field holds the distinguished name of the signing certificate's subject.

This is the identity the signature actually establishes, provided the certificate chains to a trust anchor. Check the validation results for signingCredential.trusted before treating it as meaningful: an untrusted certificate can carry any subject its issuer chose to put in it.

SigningTime
string (read-only)

Default: ""

When the claim was signed.

This field holds the signing time as an RFC 3339 date and time.

When the manifest carries an RFC 3161 time-stamp, this is the time attested by the Time Stamping Authority, and it is what allows the signature to remain verifiable after the signing certificate expires. Without a time-stamp the value is the signer's own claimed time, which carries no more weight than the rest of the claim.

Constructors

public C2PAManifest();
                
Public C2PAManifest()
                

C2PAValidationResult Type

The outcome of one validation check.

Remarks

This type holds a single result produced by Verify: one C2PA status code, what it means, and how serious it is.

The C2PA specification defines a status code per check rather than an overall verdict, because the failures differ in kind. An intact signature from an unknown signer is a question about trust; a broken content binding is evidence of tampering. Reporting them separately lets an application weigh them itself.

The following fields are available:

Fields

Code
string (read-only)

Default: ""

The C2PA status code.

This field holds the status code defined by the C2PA specification, reported verbatim so it can be matched against the specification or passed to another conforming implementation.

Frequently encountered values are:

claimSignature.validatedThe claim signature verified.
claimSignature.insideValidityThe signature was made while the certificate was valid.
signingCredential.trustedThe signing certificate chains to a trust anchor.
assertion.dataHash.matchThe asset bytes match what was signed.
claimSignature.mismatchThe claim signature did not verify.
signingCredential.untrustedThe signing certificate chains to no configured trust anchor.
signingCredential.ocsp.revokedThe signing certificate has been revoked.
assertion.dataHash.mismatchThe asset was altered after signing.

Explanation
string (read-only)

Default: ""

A human-readable description of the result.

This field describes what was checked and what was found, in text suitable for showing to a person or writing to a log.

Application logic should branch on Code rather than on this text, which is not part of the C2PA specification and may be reworded.

ManifestLabel
string (read-only)

Default: ""

The manifest the result applies to.

This field holds the urn:c2pa label of the manifest that was being checked, so results can be attributed correctly when an asset carries a chain of them.

Severity
int (read-only)

Default: 0

How serious the result is.

This field classifies the result:

0 (Success)The check passed.
1 (Informational)The check could not be completed, or reports a condition that is neither a pass nor a failure. Revocation that could not be determined lands here.
2 (Failure)The check failed. The manifest does not validate.

An asset should be treated as validated only when no result carries a severity of 2 and the successes cover the checks the application requires.

Constructors

Certificate Type

This is the digital certificate being used.

Remarks

This type describes the current digital certificate. The certificate may be a public or private key. The fields are used to identify or select certificates.

The following fields are available:

Fields

EffectiveDate
string (read-only)

Default: ""

The date on which this certificate becomes valid. Before this date, it is not valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

ExpirationDate
string (read-only)

Default: ""

The date on which the certificate expires. After this date, the certificate will no longer be valid. The date is localized to the system's time zone. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

ExtendedKeyUsage
string (read-only)

Default: ""

A comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

Fingerprint
string (read-only)

Default: ""

The hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

FingerprintSHA1
string (read-only)

Default: ""

The hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

FingerprintSHA256
string (read-only)

Default: ""

The hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

Issuer
string (read-only)

Default: ""

The issuer of the certificate. This field contains a string representation of the name of the issuing authority for the certificate.

PrivateKey
string (read-only)

Default: ""

The private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

NOTE: The PrivateKey may be available but not exportable. In this case, PrivateKey returns an empty string.

PrivateKeyAvailable
bool (read-only)

Default: false

Whether a PrivateKey is available for the selected certificate. If PrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

PrivateKeyContainer
string (read-only)

Default: ""

The name of the PrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

PublicKey
string (read-only)

Default: ""

The public key of the certificate. The key is provided as PEM/Base64-encoded data.

PublicKeyAlgorithm
string (read-only)

Default: ""

The textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

PublicKeyLength
int (read-only)

Default: 0

The length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

SerialNumber
string (read-only)

Default: ""

The serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

SignatureAlgorithm
string (read-only)

Default: ""

The text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

Store
string

Default: "MY"

The name of the certificate store for the client certificate.

The StoreType field denotes the type of the certificate store specified by Store. If the store is password-protected, specify the password in StorePassword.

Store is used in conjunction with the Subject field to specify client certificates. If Store has a value, and Subject or Encoded is set, a search for a certificate is initiated. Please see the Subject field for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

MYA certificate store holding personal certificates with their associated private keys.
CACertifying authority certificates.
ROOTRoot certificates.

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

StoreB
byte []

Default: "MY"

The name of the certificate store for the client certificate.

The StoreType field denotes the type of the certificate store specified by Store. If the store is password-protected, specify the password in StorePassword.

Store is used in conjunction with the Subject field to specify client certificates. If Store has a value, and Subject or Encoded is set, a search for a certificate is initiated. Please see the Subject field for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

MYA certificate store holding personal certificates with their associated private keys.
CACertifying authority certificates.
ROOTRoot certificates.

When the certificate store type is cstPFXFile, this property must be set to the name of the file. When the type is cstPFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

StorePassword
string

Default: ""

If the type of certificate store requires a password, this field is used to specify the password needed to open the certificate store.

StoreType
CertStoreTypes

Default: 0

The type of certificate store for this certificate.

The component supports both public and private keys in a variety of formats. When the cstAuto value is used, the component will automatically determine the type. This field can take one of the following values:

0 (cstUser - default)For Windows, this specifies that the certificate store is a certificate store owned by the current user.

NOTE: This store type is not available in Java.

1 (cstMachine)For Windows, this specifies that the certificate store is a machine store.

NOTE: This store type is not available in Java.

2 (cstPFXFile)The certificate store is the name of a PFX (PKCS#12) file containing certificates.
3 (cstPFXBlob)The certificate store is a string (binary or Base64-encoded) representing a certificate store in PFX (PKCS#12) format.
4 (cstJKSFile)The certificate store is the name of a Java Key Store (JKS) file containing certificates.

NOTE: This store type is only available in Java.

5 (cstJKSBlob)The certificate store is a string (binary or Base64-encoded) representing a certificate store in Java Key Store (JKS) format.

NOTE: This store type is only available in Java.

6 (cstPEMKeyFile)The certificate store is the name of a PEM-encoded file that contains a private key and an optional certificate.
7 (cstPEMKeyBlob)The certificate store is a string (binary or Base64-encoded) that contains a private key and an optional certificate.
8 (cstPublicKeyFile)The certificate store is the name of a file that contains a PEM- or DER-encoded public key certificate.
9 (cstPublicKeyBlob)The certificate store is a string (binary or Base64-encoded) that contains a PEM- or DER-encoded public key certificate.
10 (cstSSHPublicKeyBlob)The certificate store is a string (binary or Base64-encoded) that contains an SSH-style public key.
11 (cstP7BFile)The certificate store is the name of a PKCS#7 file containing certificates.
12 (cstP7BBlob)The certificate store is a string (binary) representing a certificate store in PKCS#7 format.
13 (cstSSHPublicKeyFile)The certificate store is the name of a file that contains an SSH-style public key.
14 (cstPPKFile)The certificate store is the name of a file that contains a PPK (PuTTY Private Key).
15 (cstPPKBlob)The certificate store is a string (binary) that contains a PPK (PuTTY Private Key).
16 (cstXMLFile)The certificate store is the name of a file that contains a certificate in XML format.
17 (cstXMLBlob)The certificate store is a string that contains a certificate in XML format.
18 (cstJWKFile)The certificate store is the name of a file that contains a JWK (JSON Web Key).
19 (cstJWKBlob)The certificate store is a string that contains a JWK (JSON Web Key).
21 (cstBCFKSFile)The certificate store is the name of a file that contains a BCFKS (Bouncy Castle FIPS Key Store).

NOTE: This store type is only available in Java and .NET.

22 (cstBCFKSBlob)The certificate store is a string (binary or Base64-encoded) representing a certificate store in BCFKS (Bouncy Castle FIPS Key Store) format.

NOTE: This store type is only available in Java and .NET.

23 (cstPKCS11)The certificate is present on a physical security key accessible via a PKCS#11 interface.

To use a security key, create a new Certificate object and pass cstPKCS11 as the StoreType, the full path of the PKCS#11 DLL as the Store, and the PIN as the StorePassword.

Code Example. SSH Authentication with Security Key (without CertMgr): sftp.SSHCert = new Certificate(CertStoreTypes.cstPKCS11, @"C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll", "123456", // PIN "CN=cert_subject"); sftp.SSHUser = "test"; sftp.SSHLogon("myhost", 22);

Alternatively, collect the necessary data using the CertMgr component by calling the ListStoreCertificates method after setting the corresponding properties accordingly. The certificate information returned in the CertList event's CertEncoded parameter may be saved for later use.

When using a certificate obtained with this approach, pass the previously saved security key information as the Store and set StorePassword to the PIN.

Code Example. SSH Authentication with Security Key (with CertMgr): certmgr.CertStoreType = CertStoreTypes.cstPKCS11; certmgr.OnCertList += (s, e) => { secKeyBlob = e.CertEncoded; }; certmgr.CertStore = @"C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll"; certmgr.CertStorePassword = "123456"; // PIN certmgr.ListStoreCertificates(); sftp.SSHCert = new Certificate(CertStoreTypes.cstPKCS11, secKeyBlob, "123456", "*"); sftp.SSHUser = "test"; sftp.SSHLogon("myhost", 22);

99 (cstAuto)The store type is automatically detected from the input data. This setting may be used with both public and private keys and can detect any of the supported formats automatically.

SubjectAltNames
string (read-only)

Default: ""

Comma-separated lists of alternative subject names for the certificate.

ThumbprintMD5
string (read-only)

Default: ""

The MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

ThumbprintSHA1
string (read-only)

Default: ""

The SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

ThumbprintSHA256
string (read-only)

Default: ""

The SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

Usage
string (read-only)

Default: ""

The text description of UsageFlags.

This value will be one or more of the following strings and will be separated by commas:

  • Digital Signature
  • Non-Repudiation
  • Key Encipherment
  • Data Encipherment
  • Key Agreement
  • Certificate Signing
  • CRL Signing
  • Encipher Only

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

UsageFlags
int (read-only)

Default: 0

The flags that show intended use for the certificate. The value of UsageFlags is a combination of the following flags:

0x80Digital Signature
0x40Non-Repudiation
0x20Key Encipherment
0x10Data Encipherment
0x08Key Agreement
0x04Certificate Signing
0x02CRL Signing
0x01Encipher Only

Please see the Usage field for a text representation of UsageFlags.

This functionality currently is not available when the provider is OpenSSL.

Version
string (read-only)

Default: ""

The certificate's version number. The possible values are the strings "V1", "V2", and "V3".

Subject
string

Default: ""

The subject of the certificate used for client authentication.

This field will be populated with the full subject of the loaded certificate. When loading a certificate, the subject is used to locate the certificate in the store.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=example@email.com". Common fields and their meanings are as follows:

FieldMeaning
CNCommon Name. This is commonly a hostname like www.server.com.
OOrganization
OUOrganizational Unit
LLocality
SState
CCountry
EEmail Address

If a field value contains a comma, it must be quoted.

Encoded
string

Default: ""

The certificate (PEM/Base64 encoded). This field is used to assign a specific certificate. The Store and Subject fields also may be used to specify a certificate.

When Encoded is set, a search is initiated in the current Store for the private key of the certificate. If the key is found, Subject is updated to reflect the full subject of the selected certificate; otherwise, Subject is set to an empty string.

EncodedB
byte []

Default: ""

The certificate (PEM/Base64 encoded). This field is used to assign a specific certificate. The Store and Subject fields also may be used to specify a certificate.

When Encoded is set, a search is initiated in the current Store for the private key of the certificate. If the key is found, Subject is updated to reflect the full subject of the selected certificate; otherwise, Subject is set to an empty string.

Constructors

public Certificate();
                
Public Certificate()
                

Creates a instance whose properties can be set.

public Certificate(string certificateFile);
                
Public Certificate(ByVal CertificateFile As String)
                

Opens CertificateFile and reads out the contents as an X.509 public key.

public Certificate(byte[] encoded);
                
Public Certificate(ByVal Encoded As Byte())
                

Parses Encoded as an X.509 public key.

public Certificate(CertStoreTypes storeType, string store, string storePassword, string subject);
                
Public Certificate(ByVal StoreType As CertStoreTypes, ByVal Store As String, ByVal StorePassword As String, ByVal Subject As String)
                

StoreType identifies the type of certificate store to use. See for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store.

After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN). The Subject parameter can also take an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load in a "Thumbprint=value" format.

public Certificate(CertStoreTypes storeType, string store, string storePassword, string subject, string configurationString);
                
Public Certificate(ByVal StoreType As CertStoreTypes, ByVal Store As String, ByVal StorePassword As String, ByVal Subject As String, ByVal ConfigurationString As String)
                

StoreType identifies the type of certificate store to use. See for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store.

ConfigurationString is a newline-separated list of name-value pairs that may be used to modify the default behavior. Possible values include "PersistPFXKey", which shows whether or not the PFX key is persisted after performing operations with the private key. This correlates to the PKCS12_NO_PERSIST_KEY CryptoAPI option. The default value is True (the key is persisted). "Thumbprint" - an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load. When specified, this value is used to select the certificate in the store. This is applicable to the cstUser , cstMachine , cstPublicKeyFile , and cstPFXFile store types. "UseInternalSecurityAPI" shows whether the platform (default) or the internal security API is used when performing certificate-related operations.

After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN). The Subject parameter can also take an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load in a "Thumbprint=value" format.

public Certificate(CertStoreTypes storeType, string store, string storePassword, byte[] encoded);
                
Public Certificate(ByVal StoreType As CertStoreTypes, ByVal Store As String, ByVal StorePassword As String, ByVal Encoded As Byte())
                

StoreType identifies the type of certificate store to use. See for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store.

After the store has been successfully opened, the component will load Encoded as an X.509 certificate and search the opened store for a corresponding private key.

public Certificate(CertStoreTypes storeType, byte[] store, string storePassword, string subject);
                
Public Certificate(ByVal StoreType As CertStoreTypes, ByVal Store As Byte(), ByVal StorePassword As String, ByVal Subject As String)
                

StoreType identifies the type of certificate store to use. See for descriptions of the different certificate stores. Store is a byte array containing the certificate data. StorePassword is the password used to protect the store.

After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN). The Subject parameter can also take an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load in a "Thumbprint=value" format.

public Certificate(CertStoreTypes storeType, byte[] store, string storePassword, string subject, string configurationString);
                
Public Certificate(ByVal StoreType As CertStoreTypes, ByVal Store As Byte(), ByVal StorePassword As String, ByVal Subject As String, ByVal ConfigurationString As String)
                

StoreType identifies the type of certificate store to use. See for descriptions of the different certificate stores. Store is a byte array containing the certificate data. StorePassword is the password used to protect the store.

After the store has been successfully opened, the component will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN). The Subject parameter can also take an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load in a "Thumbprint=value" format.

public Certificate(CertStoreTypes storeType, byte[] store, string storePassword, byte[] encoded);
                
Public Certificate(ByVal StoreType As CertStoreTypes, ByVal Store As Byte(), ByVal StorePassword As String, ByVal Encoded As Byte())
                

StoreType identifies the type of certificate store to use. See for descriptions of the different certificate stores. Store is a byte array containing the certificate data. StorePassword is the password used to protect the store.

After the store has been successfully opened, the component will load Encoded as an X.509 certificate and search the opened store for a corresponding private key.

Config Settings (C2PAVerifier Component)

The component accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the component, access to these internal properties is provided through the Config method.

C2PAVerifier Config Settings

AcceptedEKUs:   The extended key usages accepted from a claim signer.

This setting lists, comma separated, the extended key usage OIDs a signing certificate may carry to be considered authorized for claim signing.

The C2PA specification requires a validator to reject a certificate used for a purpose it is not authorized for. The default accepts 1.3.6.1.4.1.62558.2.1 (the C2PA claim signing usage), together with 1.3.6.1.5.5.7.3.4 (email protection) and 1.3.6.1.5.5.7.3.36 (document signing), which earlier versions of the specification required instead and which signers still carry.

Two usages are never accepted regardless of this setting: time-stamping and OCSP signing. A certificate valid for either of those is valid for that purpose alone and cannot sign claims.

LogLevel:   The level of detail logged through the Log event.

This setting controls the verbosity of the Log event. Possible values are 0 (None), 1 (Info, the default), 2 (Verbose), and 3 (Debug).

TrustListDate:   The date the built-in C2PA trust list was captured.

This setting reports the date of the C2PA trust list snapshot compiled into the component, as an ISO 8601 date. This setting is read only.

TrustListVersion:   The version of the built-in C2PA trust list.

This setting reports the version of the C2PA trust list compiled into the component. Use it to determine whether the built-in snapshot is current enough for your purposes, and supply newer anchors through TrustedCerts when it is not. This setting is read only.

ValidateIngredients:   Whether ingredient manifests are validated as well as the active one.

This setting controls whether the component validates the manifests of ingredients in addition to the active manifest. Validating the whole provenance chain is more thorough but slower. The default value is True.

Base Config Settings

BuildInfo:   Information about the product's build.

When queried, this setting will return a string containing information about the product's build.

GUIAvailable:   Whether or not a message loop is available for processing events.

In a GUI-based application, long-running blocking operations may cause the application to stop responding to input until the operation returns. The component will attempt to discover whether or not the application has a message loop and, if one is discovered, it will process events in that message loop during any such blocking operation.

In some non-GUI applications, an invalid message loop may be discovered that will result in errant behavior. In these cases, setting GUIAvailable to false will ensure that the component does not attempt to process external events.

LicenseInfo:   Information about the current license.

When queried, this setting will return a string containing information about the license this instance of a component is using. It will return the following information:

  • Product: The product the license is for.
  • Product Key: The key the license was generated from.
  • License Source: Where the license was found (e.g., RuntimeLicense, License File).
  • License Type: The type of license installed (e.g., Royalty Free, Single Server).
  • Last Valid Build: The last valid build number for which the license will work.
MaskSensitiveData:   Whether sensitive data is masked in log messages.

In certain circumstances it may be beneficial to mask sensitive data, like passwords, in log messages. Set this to true to mask sensitive data. The default is true.

UseInternalSecurityAPI:   Whether or not to use the system security libraries or an internal implementation.

When set to false, the component will use the system security libraries by default to perform cryptographic functions where applicable. In this case, calls to unmanaged code will be made. In certain environments, this is not desirable. To use a completely managed security implementation, set this setting to true.

Setting this configuration setting to true tells the component to use the internal implementation instead of using the system security libraries.

On Windows, this setting is set to false by default. On Linux/macOS, this setting is set to true by default.

NOTE: This setting is static. The value set is applicable to all components used in the application.

When this value is set, the product's system dynamic link library (DLL) is no longer required as a reference, as all unmanaged code is stored in that file.

Trappable Errors (C2PAVerifier Component)

C2PAVerifier Errors

101   Unsupported algorithm. The claim signature names a signature algorithm outside the set the C2PA specification permits.
102   The claim signature carries no usable signing certificate.
103   Unsupported asset format. The asset is not one of the formats the component can read a C2PA Manifest from.
105   The claim signature does not fit the space reserved for it in the Manifest.
106   A required parameter is missing or invalid.
107   The Manifest could not be laid out. This indicates a defect in the component rather than a problem with the input.
111   No C2PA Manifest was found in the asset. Most files have never been signed, so an application that inspects arbitrary files should expect this and treat it as an ordinary outcome rather than a failure.
112   The C2PA Manifest Store is malformed and could not be parsed.
305   Cannot read file.