Reference another assertion from c2pa.assertion.metadata

[demhess]

Per 2.0 of the spec we can have c2pa.assertion.metadata assertions that provide metadata about other assertions.

The content model for this calls for a reference property with a hashed-uri-map that needs the JUMBF URL of the other assertion as well as the hash of the assertion.

Can this be supported? I saw from issue 133 that I could add an instanceId to my manifest JSON to get the ingredient assertion hash. Is there a similar way to refer to other assertions?

BTW: I noticed that each time I generate a manifest the hash for the metadata assertions changes even if the assertion JSON hasn't changed. Is that because the c2patool is generating a new salt for the assertion JUMBF box? If so, is there a way to specify what the salt should be when generating a manifest so the hash will be the same each time?

[gpeacock]

We have not yet implemented 2.0 spec changes. We need to add a way to map a reference to an assertion. I'm not exactly sure how to do that yet, but we will come up with something.

You are right about the salt changing the hash. That is by design to prevent redacted assertions being identified by the hash in the claim. Allowing you to set the salt would remove that safety. Why do you want that?

[demhess]

Thanks @gpeacock !

To create an assertion hash, I initially tried generating a manifest so I could get all the hashes from the claim and then use those values to create the c2pa.assertion.metadata with the right JUMBF URL and assertion hash. But then I noticed the hashes changed.

I thought if I could use the same salt each time I generated the manifest, then the hashes would be stable and I'd be able to populate the c2pa.assertion.metadata with all the right values.