# H/M C2PA Collection Data Hash Verifier

Canonical tool: https://hogarmas.net/content-credentials/collection-hash/

This browser-local tool audits an official `c2pa.hash.collection.data` assertion against files selected by the operator. Source bytes, relative paths and hashes are not uploaded.

## Accepted assertion shapes

Bare map:

```json
{
  "alg": "sha256",
  "uris": [
    {
      "uri": "images/example.jpg",
      "hash": "BASE64_OR_HEX_DIGEST",
      "size": 12004,
      "dc:format": "image/jpeg"
    }
  ]
}
```

Assertion wrapper:

```json
{
  "label": "c2pa.hash.collection.data",
  "data": {
    "alg": "sha256",
    "uris": []
  }
}
```

The parser also accepts a crJSON object containing exactly one matching collection assertion. Supported algorithms are `sha256`, `sha384` and `sha512`. Hash values may be hexadecimal, base64, base64url, an algorithm-prefixed hexadecimal string, or a byte array.

## Standard result codes

- `assertion.collectionHash.match`: every listed URI resolved and its selected file bytes matched.
- `assertion.collectionHash.mismatch`: at least one resolved file digest differed.
- `assertion.collectionHash.incorrectFileCount`: at least one listed URI was not found.
- `assertion.collectionHash.invalidURI`: an unsafe or unsupported URI was rejected before file access.
- `assertion.collectionHash.malformed`: the supplied assertion, algorithm, entry or digest was invalid or ambiguous.

`hm.collectionHash.localAuditIncomplete` is an H/M local execution code, not a C2PA standard code. It means one or more selected files could not be read, so the audit does not claim a complete standard result.

## Coverage boundary

C2PA permits a collection assertion to cover only selected members. Files selected by the operator but absent from the assertion are reported as `not covered`; they do not become a standard mismatch. The result does not prove collection completeness.

## Security boundary

- Absolute URLs, absolute paths, backslashes, empty path segments and `.` or `..` path segments are rejected.
- Percent-encoded separators and traversal segments are rejected before local path resolution.
- At most 2,000 assertion entries and 4,000 selected local files are accepted.
- Files are processed sequentially with Web Crypto to keep memory bounded.
- No source bytes, URI, file name or digest is sent to the application server.

## Exports

- Full audit JSON: includes relative URIs and expected/observed hashes; requires explicit local consent.
- Detailed CSV: includes the same sensitive per-file evidence; requires explicit local consent.
- Markdown summary: aggregate result and boundaries only.
- Privacy-minimized receipt: excludes file names, relative URIs and expected/observed hashes. Its SHA-256 checksum detects receipt modification but is not a signature and does not authenticate the exporter.

Schemas:

- https://hogarmas.net/content-credentials/collection-hash-audit-schema.json
- https://hogarmas.net/content-credentials/collection-hash-receipt-schema.json

## Limitations

A matching collection hash validates listed byte digests at audit time. It does not validate the source manifest signature, authenticate the signer, prove authorship, prove dataset completeness, establish source custody, verify licenses or consent, prove factual truth, or certify legal compliance.

Validate the source C2PA manifest separately in the Evidence Workspace:

https://hogarmas.net/content-credentials/

Normative source:

https://spec.c2pa.org/specifications/specifications/2.4/specs/ContentCredentials.html#_validating_a_collection_data_hash