Metadata-Version: 2.4
Name: hogarmas-content-credentials
Version: 0.1.0
Summary: Privacy-first H/M adapters for the official C2PA Python SDK and local evidence-package verification.
Author-email: H/M Digital Evidence Lab <jpyesihui@gmail.com>
Project-URL: Documentation, https://hogarmas.net/content-credentials/python/
Project-URL: OpenAPI, https://hogarmas.net/openapi.json
Project-URL: Support, https://hogarmas.net/content-credentials/developers/
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: c2pa-python<0.33,>=0.32.6

# H/M Content Credentials Python adapter

Version 0.1.0 is an H/M integration layer for local evidence workflows.

It delegates source-media parsing and C2PA validation to the official
Content Authenticity Initiative package, c2pa-python. H/M code verifies the
H/M evidence-envelope, audit-report and BagIt evidence-package contracts.

This package is not an official C2PA SDK, conformance certificate, trust list,
truth detector or legal-compliance service.

## Install

    python -m pip install hogarmas_content_credentials-0.1.0-py3-none-any.whl

The wheel declares c2pa-python 0.32.x as a dependency. Python 3.10 or newer is
required.

## CLI

    hm-c2pa inspect photo.jpg --output inspection.json
    hm-c2pa verify-envelope evidence-envelope.json
    hm-c2pa verify-audit audit-report.json
    hm-c2pa verify-package hm-evidence-package.zip

All commands run locally. The adapter does not upload source files, call the
H/M REST API or write browser-style analytics. The operating system and
installed dependencies may have their own logging behavior.

## Python

    from hogarmas_content_credentials import (
        inspect_file,
        verify_audit_report_envelope,
        verify_evidence_envelope,
        verify_evidence_package,
    )

    inspection = inspect_file("photo.jpg")
    package_result = verify_evidence_package("hm-evidence-package.zip")
    print(package_result.to_dict())

The inspection result keeps cryptographic validation, signer trust, declared AI
origin and factual truth as separate concepts. A valid credential does not prove
that visible content is factually true. No credential does not prove that media
is fake or AI-generated.

## Package limits

Evidence-package verification rejects duplicate paths, traversal, absolute
paths, symbolic links, encrypted members and archives that exceed configured
file-count or uncompressed-byte limits. Payload and tag manifests are streamed
through SHA-256 rather than extracted to disk.

## Standards and upstream

- C2PA specification 2.4
- c2pa-python 0.32.x from the Content Authenticity Initiative
- BagIt 1.0 from RFC 8493
- H/M evidence-package profile 1.1.0

The H/M Evidence Package is an interoperability profile, not an official C2PA
evidence-package standard. Its checksums are not digital signatures and do not
authenticate an exporter.
