Metadata-Version: 2.4
Name: trufo-provenance
Version: 0.1.2
Summary: Trufo Provenance - core content-provenance engine (C2PA, signing, shared types).
License-Expression: LicenseRef-Trufo
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Rust
Classifier: Operating System :: POSIX :: Linux
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: boto3>=1.26
Requires-Dist: cryptography>=41.0
Requires-Dist: requests>=2.28
Provides-Extra: test
Requires-Dist: pytest>=7.0; extra == "test"
Provides-Extra: c2pa
Requires-Dist: numpy>=1.24; extra == "c2pa"
Requires-Dist: opencv-python-headless>=4.8; extra == "c2pa"
Requires-Dist: Pillow>=10.0; extra == "c2pa"
Requires-Dist: python-magic>=0.4.27; extra == "c2pa"
Dynamic: license-file

# Trufo Provenance

Trufo Provenance is Trufo's core content-provenance engine for C2PA manifest
generation, validation, remote signing integration, cryptographic signers, and
shared provenance types. It is a lower-level building block used by Trufo's
hosted services and SDKs; most application developers should install the public
`trufo` SDK instead of importing this package directly.

This package is in an alpha release state. APIs and schemas may change until the
package enters beta.

## Installation

Most SDK users should install provenance support through the public `trufo` SDK:

```bash
pip install "trufo[provenance]"
```

That SDK extra resolves this package as an implementation dependency. Direct
installation is primarily for maintainers, service deployments, and low-level
integration testing:

```bash
pip install "trufo-provenance[c2pa]"
```

The `c2pa` extra on `trufo-provenance` installs the Python dependencies needed by
the C2PA media pipeline, such as image/video helpers and file-type detection.
The native c2pa-rs bridge is bundled in the Linux wheel itself.

The distribution name is `trufo-provenance`; the Python import package is
`tfprov` for historical compatibility:

```python
import tfprov
```

Python 3.10 or newer is required. Version `0.1.0` publishes Linux wheels with
the native c2pa-rs bridge bundled. macOS and Windows wheels are not published yet.

## What's in here

- `tfprov.c2pa_py` — C2PA manifest build/parse helpers, assertions, and schemas.
- `tfprov.c2pa_rs_bridge` — ctypes loader and FFI wrappers for the native c2pa-rs bridge.
- `tfprov.c2pa_generator` — Trufo claim-generation orchestration used by hosted and SDK signing flows.
- `tfprov.crypt` — signing algorithms, key handling, local signers, KMS signers, and remote signers.
- `tfprov.util` — shared media, file, and AWS helpers.

## Relationship to other Trufo packages

- `trufo-provenance` — this package; the lower-level provenance engine.
- `trufo` — the public Python SDK. SDK users install `trufo` directly; optional
  SDK features import `trufo-provenance` from its published wheel.
- `trufo-server` — Trufo's hosted services. Server deployments use this library
  directly from the repository/deployment environment rather than through the
  `trufo` SDK extra.

## Documentation

User-facing SDK documentation lives in the `trufo` package. This package is
documented primarily for maintainers and service integrations.

## Native (Rust) C2PA path

The C2PA signing and validation path is backed by a Rust `cdylib` bridge loaded
through `ctypes`. The Linux wheel includes `libc2pa_rs_bridge.so` alongside
`tfprov.c2pa_rs_bridge`. macOS and Windows native wheels are future work.

## License

This package is distributed under the proprietary Trufo license in [LICENSE](LICENSE).
Using Trufo hosted APIs also requires valid Trufo API credentials.

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md). During alpha, external issues are welcome;
external pull requests are not accepted.
