AvifEncoder::with_c2pa_reserved(len) refuses len < 8 — a slot shorter than a JUMBF box header
(LBox/TBox) could not hold even an empty manifest store's outermost box. Its sibling
with_c2pa(store) applies no such bound. Executed against PR #506's head:
AvifEncoder::new().with_c2pa(&[0xAB; 3]).encode_with_report(img)
// -> Ok; report.c2pa = Some(77..80)
// AvifContainer::parse(&bytes).c2pa_slot()
// -> Some(C2paSlot { slot_bytes: [171, 171, 171], range: 77..80, purpose: Manifest })
AvifEncoder::new().with_c2pa_reserved(3).encode_with_report(img)
// -> Err("invalid input: AVIF: a reserved C2PA slot is at least 8 bytes, the size of a
// JUMBF box header [origin: gamut-avif]")
So the crate does produce a file with a 3-byte slot, and its own locator finds it. PR #506
corrected the documentation — with_c2pa now states that it carries a caller-supplied slice
verbatim and applies no minimum — and deleted the "strict in what it writes … a file this crate
would decline to produce is still one it will faithfully describe" claim, which the above
falsifies.
The open question: should with_c2pa reject a store shorter than MIN_SLOT_LEN too?
Arguments for: the two builders promise identical framing, and one refusing what the other emits
is a surprise; a 3-byte "manifest store" is a caller error in either spelling.
Arguments against: everywhere else in this workspace a caller-supplied metadata payload is carried
verbatim and validated nowhere (with_exif, with_xmp, the PNG/WebP raw chunk carriers), and
this crate deliberately parses nothing inside a store. A length check would be the only content
judgement the C2PA surface makes. The asymmetry is also defensible on its own terms: a reservation
is a bare integer with no other evidence behind it, while a slice is bytes the caller already
holds.
Whichever way it goes, one of the two documented contracts changes, so it is a behavioural
decision rather than a wording fix.
Refs #444, PR #506.
AvifEncoder::with_c2pa_reserved(len)refuseslen < 8— a slot shorter than a JUMBF box header(
LBox/TBox) could not hold even an empty manifest store's outermost box. Its siblingwith_c2pa(store)applies no such bound. Executed against PR #506's head:So the crate does produce a file with a 3-byte slot, and its own locator finds it. PR #506
corrected the documentation —
with_c2panow states that it carries a caller-supplied sliceverbatim and applies no minimum — and deleted the "strict in what it writes … a file this crate
would decline to produce is still one it will faithfully describe" claim, which the above
falsifies.
The open question: should
with_c2pareject a store shorter thanMIN_SLOT_LENtoo?Arguments for: the two builders promise identical framing, and one refusing what the other emits
is a surprise; a 3-byte "manifest store" is a caller error in either spelling.
Arguments against: everywhere else in this workspace a caller-supplied metadata payload is carried
verbatim and validated nowhere (
with_exif,with_xmp, the PNG/WebP raw chunk carriers), andthis crate deliberately parses nothing inside a store. A length check would be the only content
judgement the C2PA surface makes. The asymmetry is also defensible on its own terms: a reservation
is a bare integer with no other evidence behind it, while a slice is bytes the caller already
holds.
Whichever way it goes, one of the two documented contracts changes, so it is a behavioural
decision rather than a wording fix.
Refs #444, PR #506.