isGenAI controlled C2PA examples, reviewed 3 October 2026

Rights: CC0-1.0. The unsigned pixels are an exact copy of our code-drawn public/examples/guide-lab/without-records.png, already published under CC0. No real camera, person, image-generation model or external media asset was used. The test-signed copy preserves exactly the same decoded pixels.

Files:
- unsigned-control.png: NO_C2PA_MANIFEST, no signature or signer present.
- test-signed.png: C2PA_VALIDATED_WITH_WARNINGS, cryptographic_validation VALIDATED, trust_validation UNTRUSTED_OR_UNKNOWN. The SDK state is Valid with claimSignature.validated and assertion.dataHash.match; signingCredential.untrusted remains in the returned codes.
- results.json: exact SHA-256 hashes, file sizes, app-level inspection output, environment and tamper-test observation.
- reader-observations.json: underlying SDK output recorded at generation.
- reproduce.mjs: reproduction source; no private key or production credential is included.

Recorded claim: c2pa.created with IPTC algorithmicMedia (software-generated pixels without sampled training data). It is a declared claim, not an independently observed event or detector result.

Reproduction:
Requires Node.js >=22, OpenSSL and @contentauth/c2pa-node 0.8.3. In the repository these dependencies are already installed. Run:
  node public/examples/c2pa-lab/reproduce.mjs
This overwrites the signed fixture and underlying reader observations. It creates a new test CA and leaf signing key in an isolated temporary directory, uses no trust overrides or remote timestamp service, and deletes both private keys on exit. The keys are never reused for production. Fresh certificates/signatures change file hashes; they do not reproduce identical signed bytes. The committed development certificate expires in October 2036.
Verify the app-level results and pixel identity, and update results.json, with:
  npx tsx tests/c2pa-lab.test.ts --write-observations
If republishing regenerated fixtures, update the local controlled-example analytics fingerprint as well. Do not count fixture checks as real user conversions.

Negative test: a byte inside the signed PNG's IDAT image-data payload is changed in memory. The checker reports C2PA_INVALID with assertion.dataHash.mismatch. The modified image is not published as a usable image.

The test suite also checks a deliberately synthetic AI claim in tests/fixtures/c2pa. That fixture is not a real AI-generated image and is not presented as an accuracy benchmark. An untrusted signed AI declaration must not become trusted camera evidence or a verified-origin result.

Limits: these examples establish behavior for these exact files in the recorded environment. They do not establish detector accuracy, a complete edit history, signer identity or factual truth. Signature validity and signer trust remain separate; a missing manifest says nothing by itself about origin. Results may change with validation software, trust information or certificate expiry. Repeat the check with the same file hash when comparing environments.

Primary references:
https://opensource.contentauthenticity.org/docs/signing/test-certs/
https://github.com/contentauth/c2pa-js/tree/main/packages/c2pa-node
https://cv.iptc.org/newscodes/digitalsourcetype/algorithmicMedia