Skip to content

gamut-avif: should AvifEncoder::with_c2pa apply the reserved slot's 8-byte minimum? #577

Description

@justin13888

AvifEncoder::with_c2pa_reserved(len) refuses len < 8 — a slot shorter than a JUMBF box header
(LBox/TBox) could not hold even an empty manifest store's outermost box. Its sibling
with_c2pa(store) applies no such bound. Executed against PR #506's head:

AvifEncoder::new().with_c2pa(&[0xAB; 3]).encode_with_report(img)
// -> Ok; report.c2pa = Some(77..80)
// AvifContainer::parse(&bytes).c2pa_slot()
//   -> Some(C2paSlot { slot_bytes: [171, 171, 171], range: 77..80, purpose: Manifest })

AvifEncoder::new().with_c2pa_reserved(3).encode_with_report(img)
// -> Err("invalid input: AVIF: a reserved C2PA slot is at least 8 bytes, the size of a
//         JUMBF box header [origin: gamut-avif]")

So the crate does produce a file with a 3-byte slot, and its own locator finds it. PR #506
corrected the documentation — with_c2pa now states that it carries a caller-supplied slice
verbatim and applies no minimum — and deleted the "strict in what it writes … a file this crate
would decline to produce is still one it will faithfully describe" claim, which the above
falsifies.

The open question: should with_c2pa reject a store shorter than MIN_SLOT_LEN too?

Arguments for: the two builders promise identical framing, and one refusing what the other emits
is a surprise; a 3-byte "manifest store" is a caller error in either spelling.

Arguments against: everywhere else in this workspace a caller-supplied metadata payload is carried
verbatim and validated nowhere (with_exif, with_xmp, the PNG/WebP raw chunk carriers), and
this crate deliberately parses nothing inside a store. A length check would be the only content
judgement the C2PA surface makes. The asymmetry is also defensible on its own terms: a reservation
is a bare integer with no other evidence behind it, while a slice is bytes the caller already
holds.

Whichever way it goes, one of the two documented contracts changes, so it is a behavioural
decision rather than a wording fix.

Refs #444, PR #506.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions