Skip to main content

General FAQs

Where can I find signed sample assets?​

Use Proofmode's public Baseline repository has signed sample assets, but be aware that much of its content uses older C2PA 1.x support. Use the contentauth/example-assets repository to submit signed assets for testing. Neither repository guarantees a complete, current conformance test suite.

For location metadata, see the Proofmode Android 3.0.2 release candidate and its use of c2pa.metadata to include geolocation as a created assertion. Older conformance samples used stds.exif, described as deprecated but still valid. See the Kotlin metadata-generation code.

Sources:

How can I get started with Content Credentials on Android or iOS?​

Use the mobile SDKs for Android and iOS.

Does a Valid validation state mean that the signer is trusted?​

No. There are three manifest states: well-formed, valid, and trusted. Trusted manifests are also valid, and valid manifests are also well-formed. The reverse does not follow.

A manifest signed with a test certificate can have a Valid state while validation_results.activeManifest.failure contains signingCredential.untrusted. This follows the manifest-state model.

Do not label a manifest trusted merely because its state is Valid. Inspect the trust-related validation results, and distinguish trust that was not evaluated from a failed trust check. An issuer name alone does not establish trust.

See the manifest states specification.

Sources:

Can a manifest carry custom sensor or verification information?​

Yes. You can add custom assertions to a C2PA manifest. A validator that understands that assertion could use its information to identify where changes occurred.

That is an extensibility mechanism, not endorsement of the proposal's claimed security guarantees or a promise that existing validators understand it. A camera/editor workflow needs compatible implementations; custom assertions alone do not provide that coordination.

Source: custom assertions and validator support, April 20, 2026

Where are embedding rules for TIFF-based and base-media file formats documented?​

See the Embedded Formats annex of the Content Credentials specification. for embedding rules relevant to TIFF-based Sony formats and the base-media-based Canon CR3 format.

This is a specification pointer, not confirmation that every raw camera format is supported by a particular SDK or that camera samples are available.

Source: Embedded Formats annex, August 17, 2026

Where can I report a CAI security concern?​

Use the CAI contact form to report a security concern. Do not assume a dedicated security inbox, a response deadline, or public status updates are available.

Sources:

Why might an HEIC thumbnail not appear in Verify?​

Signing and display are separate issues. If a thumbnail's format changes to application/octet-stream during signing, use a v2 claim: set claim_version to 2, or omit it if your version defaults to v2.

Display also depends on browser support. As of September 2026, image/heic thumbnails displayed in macOS Safari but not Chrome. A correctly embedded thumbnail therefore did not guarantee display in every browser. These observations are historical, not a current browser compatibility matrix.

Sources: