|
#!/usr/bin/env bash |
|
|
|
if [ "$TRUEPIC_DEBUG" = "2" ]; then |
|
set -xeo pipefail |
|
else |
|
set -eo pipefail |
|
fi |
|
|
|
debug_echo() { |
|
if [ -n "$TRUEPIC_DEBUG" ]; then |
|
echo "$@" |
|
fi |
|
} |
|
|
|
MEDIA_FILE=$(readlink -f "$1") |
|
OUTPUT_FILE=$2 |
|
shift |
|
shift |
|
|
|
TRUEPIC_CLI=/home/user/app/truepic |
|
STEG_SCRIPTS=/home/user/app/scripts/ |
|
PRIVATE_KEY=/home/user/.truepic/truepic/private.key |
|
|
|
filename=$(basename "${MEDIA_FILE}") |
|
extension="${filename##*.}" |
|
if [ "${extension}" = "jpg" ] || [ "${extension}" = "jpeg" ]; then |
|
mime_type="image/jpeg" |
|
else |
|
if [ "${extension}" = "png" ]; then |
|
mime_type="image/png" |
|
else |
|
echo "Unsupported file extension: ${extension}" |
|
exit 1 |
|
fi |
|
fi |
|
|
|
debug_echo -n "Signing media..." |
|
signed_no_watermark=$(mktemp).${extension} |
|
${TRUEPIC_CLI} sign --profile truepic $MEDIA_FILE "$@" --output ${signed_no_watermark} > /dev/null 2>&1 |
|
debug_echo " --> ${signed_no_watermark}" |
|
|
|
debug_echo |
|
debug_echo -n "Extracting manifest..." |
|
no_watermark_manifest=$(mktemp).bin |
|
${TRUEPIC_CLI} manifest extract ${signed_no_watermark} --output ${no_watermark_manifest} > /dev/null 2>&1 |
|
debug_echo " --> ${no_watermark_manifest}" |
|
|
|
debug_echo |
|
debug_echo -n "Creating watermark signature..." |
|
verification_json=$(${TRUEPIC_CLI} verify ${signed_no_watermark}) |
|
if echo "${verification_json}" | jq -e '.manifest_store[0].assertions."c2pa.thumbnail.claim.jpeg"' >/dev/null; then |
|
thumbnail_key="c2pa.thumbnail.claim.jpeg" |
|
else |
|
if echo "${verification_json}" | jq -e '.manifest_store[0].assertions."c2pa.thumbnail.claim.png"' >/dev/null; then |
|
thumbnail_key="c2pa.thumbnail.claim.png" |
|
else |
|
echo "Couldn't find thumbnail assertion in the C2PA manifest." |
|
exit 1 |
|
fi |
|
fi |
|
thumbnail_hash=$( |
|
echo "${verification_json}" | \ |
|
jq -r '.manifest_store[0].assertions."'${thumbnail_key}'"[0].thumbnail_id' |
|
) |
|
timestamp=$( |
|
echo "${verification_json}" | \ |
|
jq -r '.manifest_store[0].trusted_timestamp.timestamp' |
|
) |
|
debug_echo -n " ${thumbnail_hash}|${timestamp} ..." |
|
watermark_signature=$(openssl dgst -sha256 -sign ${PRIVATE_KEY} <(echo "${thumbnail_hash}|${timestamp}") | base64 | tr -d '\n') |
|
debug_echo " ${watermark_signature}" |
|
|
|
debug_echo |
|
debug_echo -n "Uploading signed media to steg.ai..." |
|
media_id=$(${STEG_SCRIPTS}/upload.sh ${signed_no_watermark} ${mime_type}) |
|
debug_echo " --> media_id=${media_id}" |
|
rm -f ${signed_no_watermark} |
|
|
|
debug_echo |
|
debug_echo -n "Uploading manifest to steg.ai..." |
|
manifest_id=$(${STEG_SCRIPTS}/upload.sh ${no_watermark_manifest} "application/cbor") |
|
debug_echo " --> media_id=${manifest_id}" |
|
|
|
debug_echo |
|
debug_echo -n "Watermarking media..." |
|
encode_response=$( |
|
curl -s https://api.steg.ai/encode_image_async \ |
|
-H "x-api-key: ${STEG_AI_API_KEY}" \ |
|
--data-raw '{ |
|
"media_id": "'${media_id}'", |
|
"method": 0, |
|
"owner": "Truepic", |
|
"custom": "{\"manifest_id\":\"'${manifest_id}'\",\"watermark_signature\": \"'${watermark_signature}'\"}" |
|
}' |
|
) |
|
request_id=$(echo "$encode_response" | jq -r '.data.request_id') |
|
|
|
if [ -z "$request_id" ] || [ "$request_id" = "null" ]; then |
|
debug_echo |
|
echo "No request_id" |
|
rm -f ${no_watermark_manifest} |
|
exit 1; |
|
fi |
|
|
|
watermark_id=$(echo "$encode_response" | jq -r '.data.encode_media_id') |
|
|
|
status_response="" |
|
watermarking_status="" |
|
while [ "$watermarking_status" != "Completed." ]; do |
|
sleep 1 |
|
debug_echo -n ".." |
|
status_response=$( |
|
curl -s https://api.steg.ai/media_status?request_id=${request_id} \ |
|
-H "x-api-key: ${STEG_AI_API_KEY}" |
|
) |
|
watermarking_status=$(echo "${status_response}" | jq -r '.data.status') |
|
done |
|
|
|
download_url=$(echo "${status_response}" | jq -r '.data.media_data.media_url') |
|
debug_echo " --> media_id=${watermark_id}" |
|
|
|
debug_echo |
|
debug_echo -n "Downloading watermarked media..." |
|
watermarked_image=$(mktemp).${extension} |
|
curl -s -o ${watermarked_image} "$download_url" |
|
debug_echo " --> ${watermarked_image}" |
|
|
|
debug_echo |
|
debug_echo -n "Re-signing the watermarked media..." |
|
${TRUEPIC_CLI} sign --profile steg ${watermarked_image} \ |
|
--ingredient-manifest-store ${no_watermark_manifest} \ |
|
--output "${OUTPUT_FILE}" \ |
|
--assertions-inline '{ |
|
"assertions": [ |
|
{ |
|
"label": "c2pa.actions", |
|
"data": { |
|
"actions": [ |
|
{ |
|
"action": "ai.steg.watermark", |
|
"when": "@now", |
|
"softwareAgent": "steg.ai", |
|
"parameters": { |
|
"description": "An imperceptible digital watermark was added to the file, which can be used to retrieve information later." |
|
} |
|
} |
|
] |
|
} |
|
} |
|
] |
|
}' > /dev/null 2>&1 |
|
debug_echo " --> ${OUTPUT_FILE}" |
|
rm -f ${no_watermark_manifest} |
|
|
|
debug_echo |
|
debug_echo -n "Extracting new manifest..." |
|
with_watermark_manifest=$(mktemp).bin |
|
${TRUEPIC_CLI} manifest extract "${OUTPUT_FILE}" --output ${with_watermark_manifest} > /dev/null 2>&1 |
|
debug_echo " --> ${with_watermark_manifest}" |
|
|
|
debug_echo |
|
debug_echo -n "Uploading new manifest to steg.ai..." |
|
new_manifest_id=$(${STEG_SCRIPTS}/upload.sh ${with_watermark_manifest} "application/cbor") |
|
debug_echo " --> media_id=${new_manifest_id}" |
|
rm -f ${with_watermark_manifest} |
|
|
|
debug_echo |
|
debug_echo -n "Updating media with new manifest ID... " |
|
update_result=$( |
|
curl -s https://api.steg.ai/asset \ |
|
-X POST \ |
|
-H "x-api-key: ${STEG_AI_API_KEY}" \ |
|
--data-raw '{ |
|
"media_id" : "'${watermark_id}'", |
|
"custom": "{\"manifest_id\":\"'${new_manifest_id}'\",\"watermark_signature\":\"'${watermark_signature}'\",\"original_id\":\"'${watermark_id}'\"}" |
|
}' |
|
) |
|
|
|
debug_echo ${update_result} | jq -r '.message' |
|
|
|
debug_echo |
|
debug_echo -n "Deleting un-watermarked image (${media_id}) from steg.ai... " |
|
delete_result=$( |
|
curl -s https://api.steg.ai/asset \ |
|
-X DELETE \ |
|
-H "x-api-key: ${STEG_AI_API_KEY}" \ |
|
--data-raw '{ |
|
"media_id" : "'${media_id}'" |
|
}' |
|
) |
|
|
|
if [ -n "$TRUEPIC_DEBUG" ]; then echo ${delete_result} | jq -r '.message'; fi |
|
|
|
debug_echo |
|
debug_echo -n "Deleting old manifest (${manifest_id}) from steg.ai... " |
|
delete_result=$( |
|
curl -s https://api.steg.ai/asset \ |
|
-X DELETE \ |
|
-H "x-api-key: ${STEG_AI_API_KEY}" \ |
|
--data-raw '{ |
|
"media_id" : "'${manifest_id}'" |
|
}' |
|
) |
|
|
|
if [ -n "$TRUEPIC_DEBUG" ]; then echo ${delete_result} | jq -r '.message'; fi |
