c2pa-python

What it is and what it does

c2pa-python is a Python wrapper around the C2PA (Content Authenticity Initiative) Rust library, enabling developers to work with C2PA manifests—cryptographic records that establish the origin, history, and authenticity of digital media. It lets you read and validate existing manifests embedded in media files, and create new manifests by signing media with various cryptographic algorithms and attaching provenance metadata.

The library handles the full lifecycle of manifest operations: reading and verifying signatures, adding assertions (such as "Do Not Train" markers), including ingredient references, and writing signed manifests back to media files. It depends on cryptography for signing operations and requests for network calls, and ships as prebuilt wheels for common platforms, making installation straightforward on macOS, Linux, and Windows.

Use it for:

• Verify the authenticity and provenance chain of media files received from external sources or user uploads.
• Embed "Do Not Train" or other machine-learning-related assertions into images or media to control downstream use.
• Build a content management system that signs and tracks the origin of all media assets with cryptographic proof.
• Validate that media files have not been tampered with since they were signed by a trusted source.
• Add ingredient references to derived media to document the source materials used in creation.
• Audit and extract metadata from manifests to generate reports on content provenance and modification history.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Read, validate, create, and sign C2PA manifest data in media files to establish content authenticity and provenance.

Yes. The package is actively maintained (release 1 day old), has no known vulnerabilities, supports current Python versions (3.10+), and solves a real problem in content authenticity. Medium install friction is acceptable given the prebuilt wheels for common platforms. Permissive dual licensing (MIT/Apache-2.0) poses no legal barrier. Install if you need to read, validate, or sign C2PA manifests in media files.

Install

c2pa-python on PyPI

pip install c2pa-python

uv add c2pa-python

poetry add c2pa-python

Installing c2pa-python

Before you install

Medium install friction due to prebuilt binary wheels for multiple platforms (macOS universal/x86_64/arm64, Linux x86_64/aarch64, Windows x86_64/arm64). Active maintenance with a release 1 day old; last commit 2026-08-13. Requires Python 3.10+.

License in practice

Dual-licensed under MIT OR Apache-2.0 (permissive). Either license permits commercial and private use with minimal restrictions; choose whichever suits your project's existing license.

Quickstart

pip install c2pa-python

import c2pa

# Read and validate a manifest from a media file
manifest = c2pa.read_file('path/to/media_file')
if manifest:
    print(manifest.validation_status)

Requires Python 3.10 or later. Prebuilt wheels available for macOS (10.9+), Linux (glibc 2.28+), and Windows; other platforms may require building from local c2pa-rs sources.

Verify before relying

• Supported media formats beyond what the description excerpt lists (references external docs for full format support).
• Performance characteristics when processing large media files or batch operations.
• Whether cryptography and requests are used directly in typical workflows or only as transitive dependencies.

Package facts

Evidence: c2pa_python-0.37.7-py3-none-macosx_10_9_universal2.whl; c2pa_python-0.37.7-py3-none-macosx_10_9_x86_64.whl; c2pa_python-0.37.7-py3-none-macosx_11_0_arm64.whl; c2pa_python-0.37.7-py3-none-manylinux_2_28_aarch64.whl; c2pa_python-0.37.7-py3-none-manylinux_2_28_x86_64.whl; c2pa_python-0.37.7-py3-none-win_amd64.whl; c2pa_python-0.37.7-py3-none-win_arm64.whl

Tags

More Cryptography packages