c2pa-sign

/socialforge:c2pa-sign — Embed Content Authenticity Provenance

Script location. If your host does not set ${CLAUDE_PLUGIN_ROOT}, the scripts are in this plugin's scripts/ folder, next to skills/. Run them with Python 3.10 or newer: python, or python3 where python is not found (macOS, many Linux systems).

Purpose

Context efficiency

Asset-heavy skill. Grep before Read the asset catalog (${CLAUDE_PLUGIN_DATA}/socialforge/brands/<brand>/asset-index.json) — never list the asset directory. Reference generated images / videos by path, not by loading metadata. Brand profile loads once per session.

Wraps scripts/c2pa_sign.py to add a C2PA manifest to any SocialForge-generated marketing asset. The manifest carries:

• Machine-readable provenance trail (brand, generator name, timestamp, prompt, target platform)
• IPTC digital-source-type vocabulary tag (TRAINED_ALGORITHMIC_MEDIA / COMPOSITE_WITH_TRAINED_ALGORITHMIC_MEDIA / HUMAN_EDITS)
• schema.org CreativeWork assertion (author = brand organization, dateCreated, publishingPrinciples = target platform)

Why this matters: EU AI Act Article 50 applies from 2 August 2026. Generative-AI marketing content distributed in EU markets must be marked in a machine-readable format using open, interoperable standards — C2PA is the emerging backbone. Penalty: up to €15 million or 3% global annual turnover. Additional disclosure obligations apply under NY synthetic-performer law (effective June 2026) and FTC May 2026 endorsement guidance.

The resulting asset is verifiable at contentcredentials.org/verify or in any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, Microsoft Copilot, etc.).

C2PA spec versions relevant to SocialForge (June 2026)

• Content Credentials 2.3 (released 9 February 2026 — launch post) added support for live video (broadcast/streaming), plain text documents, OGG Vorbis audio, large AVI video files, and EXIF Original Preservation Images. Relevant to SocialForge because:
  • Live video signing matters if you're producing Reels / TikTok / Shorts streaming content alongside the planned monthly batch.
  • EXIF Original Preservation Image format is the cleanest path for signing product photography that the brand wants to preserve through ad ops cropping.
• C2PA Spec 2.5 is current (October 2026). This skill was written against 2.4 and the pinned c2pa-python; read 2.5's changes before relying on a 2.5-only field. Spec 2.4 (April 2026 — spec.c2pa.org/specifications/specifications/2.4) introduces the AI Disclosure Assertion (c2pa.ai-disclosure) — machine-readable AI transparency info that the EU AI Act Article 50 deployer pathway will read. When c2pa_sign.py is on a C2PA SDK ≥ 0.36 that handles 2.4, include this assertion alongside the existing IPTC + schema.org tags. The combination is what the EU Code of Practice WG1/WG2 drafts reference as the canonical machine-readable mark.
• C2PA Trust List is now handled via the public C2PA Conformance Program — production signing certificates should come from a Conformance-Program-listed CA.

For the regulatory context (EU Article 50, the voluntary Code of Practice, the provider-vs-deployer obligations split, and where SocialForge falls), see references/eu-ai-act-article50.md in this plugin.

What each platform does with the manifest after upload (which read it, which show a label, which drop it — each claim graded primary or secondary): content-credentials-by-platform.md. Read it before telling a client how a signed asset will appear on a given platform.

When SocialForge invokes this automatically

If a brand profile sets c2pa_auto_sign: true, the image and video generation pipelines call this script as a post-generation step before delivering the asset. The signed file replaces the unsigned one — original output path is preserved.

If the brand profile does NOT set c2pa_auto_sign: true, generated assets are unsigned by default. You can sign on demand by invoking this skill explicitly.

Quick examples

# Sign an image generated by Vertex AI for Instagram
/socialforge:c2pa-sign \
    --input assets/q3-launch-hero.png \
    --output assets/signed/q3-launch-hero.png \
    --brand "Acme Corp" \
    --generator "<provider> / <model id>" \
    --ai-claim ai-generated-content \
    --platform instagram

# Sign a generated video for TikTok
/socialforge:c2pa-sign \
    --input campaigns/launch.mp4 \
    --output campaigns/signed/launch.mp4 \
    --brand "Acme Corp" \
    --generator "<provider> / <model id>" \
    --ai-claim ai-generated-content \
    --platform tiktok

# Production sign with a real C2PA certificate
/socialforge:c2pa-sign \
    --input assets/q3-launch-hero.png \
    --output assets/signed/q3-launch-hero.png \
    --brand "Acme Corp" \
    --generator "<provider> / <model id>" \
    --ai-claim ai-generated-content \
    --platform instagram \
    --signing-cert /secure/c2pa-prod-cert.pem \
    --signing-key /secure/c2pa-prod-key.pem

AI claim values (IPTC digital source type)

Value	When to use
ai-generated-content	Asset fully generated by AI (default for SocialForge image/video output)
ai-assisted-edits	Human-created asset with AI editing (e.g. brand-watermarked stock photo + AI background replacement)
ai-no-substantive-changes	AI used but no semantic change (e.g. AI upscaling, AI noise reduction)

Supported asset formats

Image: .png · .jpg/.jpeg · .webp · .gif · .tiff Video: .mp4 · .mov · .webm Audio: .mp3 · .wav

Signing certificate

Production C2PA signatures require a certificate from a CAI-recognized signing authority (Adobe, Truepic, Numbers Protocol, Microsoft Azure Confidential Ledger). Pass --signing-cert and --signing-key for production. If omitted, the script generates a self-signed 90-day dev certificate — assets sign successfully but verify as "signature present, signer not in trust list" at contentcredentials.org/verify. Do not ship dev-cert-signed assets to production.

For production deployment:

1. Obtain a C2PA-compatible signing certificate from a CAI-recognized authority
2. Store cert + key securely (not in git; use environment variables or a secret store)
3. Either pass paths on every invocation OR set c2pa_signing_cert_path and c2pa_signing_key_path in brand profile so the auto-sign hook picks them up

Reference: opensource.contentauthenticity.org/docs/manifest/signing-manifests/

Python dependencies

• c2pa-python==0.38.0 (the version the script was tested against)
• cryptography==46.0.6 — only required for the dev self-signed cert path

Neither is installed for you. If c2pa-python is missing, the script stops with the exact pinned command (python "${CLAUDE_PLUGIN_ROOT}/scripts/install_deps.py" --groups c2pa prints it; add --install to have the script run it, or set SOCIALFORGE_INSTALL_DEPS=1 for one run). cryptography is not installed for you either: without it the dev self-signed path fails with an error, so install it first.

Output

JSON status report to stdout:

{
  "status": "success",
  "input": "assets/q3-launch-hero.png",
  "output": "assets/signed/q3-launch-hero.png",
  "size_bytes": 482371,
  "brand": "Acme Corp",
  "generator": "<provider> / <model id>",
  "ai_claim": "ai-generated-content",
  "c2pa_digital_source_type": "TRAINED_ALGORITHMIC_MEDIA",
  "platform": "instagram",
  "created": "2026-05-17T10:30:00+00:00",
  "manifest_embedded_and_verified": true,
  "c2pa_active_manifest_id": "urn:c2pa:...",
  "using_dev_cert": false,
  "verify_url": "https://contentcredentials.org/verify"
}

Interoperability

This skill is intentionally self-contained — signing requires nothing beyond this plugin. Manifests follow the open C2PA spec (same manifest schema, same IPTC vocabulary), so any standards-compliant C2PA tool verifies a SocialForge-signed asset identically, and assets signed elsewhere verify here.

Related

• scripts/c2pa_sign.py — the underlying implementation
• scripts/generate_image.py — calls c2pa_sign.py as a post-step when brand profile has c2pa_auto_sign: true
• scripts/video_postprocess.py — same auto-sign hook for video output
• references/eu-ai-act-article50.md — regulatory context
• C2PA spec 2.5 (October 2026)
• Content Authenticity Initiative