updates

Dockerfile

@@ -36,6 +36,9 @@ RUN unzip truepic-lens-cli-51f4cfbc6472a2205e53d726713619ca8df5340b-ubuntu-20.04
 RUN tar -xf truepic-lens-cli-51f4cfbc6472a2205e53d726713619ca8df5340b-ubuntu-20.04.tar.gz
 
 RUN chmod +x truepic
+RUN chmod +x scripts/sign.sh
+RUN chmod +x scripts/verify.sh
+RUN chmod +x scripts/upload.sh
 
 RUN --mount=type=secret,id=api_key,mode=0444,required=true \
  ./truepic enroll file-system --api-key $(cat /run/secrets/api_key)

main.py

@@ -91,6 +91,13 @@ def verify_image(fileUpload: UploadFile):
         #    ]
         # )
 
+        subprocess.check_output(
+             [
+                "export",
+                "STEG_AI_API_KEY=" + os.environ.get("steg_api_key"),
+            ]
+        )
+
         subprocess.check_output(
              [
                 "./scripts/sign.sh",

scripts/upload.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -e
+
+FILE=$(readlink -f "$1")
+FORMAT=$2
+
+json_data=$(
+  curl -s https://api.steg.ai/upload \
+      -H "x-api-key: ${STEG_AI_API_KEY}" \
+      --data-raw '{ "name": "'$(basename "${FILE}")'", "content_type": "'$FORMAT'" }')
+
+readarray -t fields < <(echo "${json_data}" | jq -r '.data.post_to.fields | keys[]')
+media_id=$(echo "${json_data}" | jq -r '.data.media_id')
+presigned_url=$(echo "${json_data}" | jq -r '.data.post_to.url')
+
+# Iterate over the keys array and build the curl parameters
+form_string=""
+for field in "${fields[@]}"; do
+  value=$(echo "${json_data}" | jq -r --arg key "${field}" '.data.post_to.fields[$key]')
+  form_string+="--form ${field}=${value} "
+done
+
+curl -s --location --request POST ${presigned_url} ${form_string} --form "file=@${FILE}"
+
+echo ${media_id}

scripts/verify.sh

@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+
+set -e
+
+MEDIA_FILE=$(readlink -f "$1")
+
+TRUEPIC_CLI=/home/user/app/truepic
+STEG_SCRIPTS=/home/user/app/scripts/
+
+echo -n "Checking for C2PA data in the media..."
+set +e
+verification_json=$(${TRUEPIC_CLI} verify $MEDIA_FILE 2>&1)
+set -e
+
+if jq -e . <<< "$verification_json" >/dev/null 2>&1; then
+  echo " embedded C2PA manifest found."
+  echo
+  echo ${verification_json} | jq
+  exit 0
+fi
+echo " no embedded C2PA manifest found."
+
+echo
+echo -n "Uploading media to steg.ai..."
+media_id=$(${STEG_SCRIPTS}/upload.sh ${MEDIA_FILE} "image/jpeg")
+echo " --> media_id=${media_id}"
+
+echo
+echo -n "Detecting a watermark..."
+decode_response=$(
+  curl -s https://api.steg.ai/decode_image_async \
+    -H "x-api-key: ${STEG_AI_API_KEY}" \
+    --data-raw '{ "media_id": "'${media_id}'" }'
+)
+request_id=$(echo "$decode_response" | jq -r '.data.request_id')
+
+if [ -z "$request_id" ] || [ "$request_id" = "null" ]; then
+  echo
+  echo "No request_id"
+  exit 1;
+fi
+
+status_response=""
+decode_status=""
+while [ "$decode_status" != "Completed." ]; do
+  sleep 1
+  echo -n ".."
+  status_response=$(
+    curl -s https://api.steg.ai/media_status?request_id=${request_id} \
+      -H "x-api-key: ${STEG_AI_API_KEY}"
+  )
+  decode_status=$(echo "${status_response}" | jq -r '.data.status')
+done
+
+manifest_id=$(echo "${status_response}" | jq -r '.data.media_data.custom' | jq -r '.manifest_id')
+watermark_signature=$(echo "${status_response}" | jq -r '.data.media_data.custom' | jq -r '.watermark_signature')
+
+if [ -z "$manifest_id" ] || [ "$manifest_id" = "null" ]; then
+  echo
+  echo "No manifest_id"
+else
+  echo " --> media_id=${manifest_id}"
+fi
+
+echo
+echo -n "Deleting uploaded media (${media_id}) from steg.ai... "
+delete_result=$(
+  curl -s https://api.steg.ai/asset \
+    -X DELETE \
+    -H "x-api-key: ${STEG_AI_API_KEY}" \
+    --data-raw '{
+        "media_id" : "'${media_id}'"
+      }'
+)
+
+if [ -z "$manifest_id" ] || [ "$manifest_id" = "null" ]; then
+  exit 1
+fi
+
+echo ${delete_result} | jq -r '.message'
+echo
+echo -n "Downloading manifest..."
+manifest_info=$(curl -s https://api.steg.ai/asset?media_id=${manifest_id} -H "x-api-key: ${STEG_AI_API_KEY}")
+manifest_url=$(echo ${manifest_info} | jq -r '.data[0].path')
+downloaded_manifest=$(mktemp).bin
+curl -s -o ${downloaded_manifest} ${manifest_url}
+echo " --> ${downloaded_manifest}"
+
+echo
+echo -n "Inserting manifest into media file..."
+${TRUEPIC_CLI} manifest insert ${downloaded_manifest} $MEDIA_FILE --output re_inserted_image.jpg > /dev/null 2>&1
+echo " --> re_inserted_image.jpg"
+
+echo
+echo "Checking the manifest."
+verification_json=$(${TRUEPIC_CLI} verify re_inserted_image.jpg)
+
+hash_status=$(
+  echo "${verification_json}" | \
+  jq -r '.manifest_store[] | select(.is_active == true) | .assertions."c2pa.hash.data"[0].status'
+)
+thumbnail_hash=$(
+  echo "${verification_json}" | \
+  jq -r '.manifest_store[0].assertions."c2pa.thumbnail.claim.jpeg"[0].thumbnail_id'
+)
+timestamp=$(
+  echo "${verification_json}" | \
+  jq -r '.manifest_store[0].trusted_timestamp.timestamp'
+)
+public_key=$(
+  echo "${verification_json}" | \
+  jq -r '.manifest_store[] | select(.is_active == true) | .certificate.cert_der' | \
+  base64 -d | \
+  openssl x509 -pubkey -noout
+)
+
+echo -n "Checking watermark signature... ${thumbnail_hash}|${timestamp} ... ${watermark_signature} ..."
+signature_verification=$(
+  openssl dgst -sha256 \
+    -verify <(echo "${public_key}") \
+    -signature <(echo "${watermark_signature}" | base64 -d) \
+    <(echo "${thumbnail_hash}|${timestamp}")
+)
+
+echo " ${signature_verification}"
+
+echo -n "Checking image hash..."
+if [ "$hash_status" = "VALID" ]; then
+  echo " hashes match."
+  echo "${verification_json}" | jq
+  rm -f ${downloaded_manifest}
+  exit 0
+fi
+echo " hashes DON'T match!"
+rm -f re_inserted_image.jpg
+
+echo
+echo -n "Re-signing the watermarked media..."
+${TRUEPIC_CLI} sign ${MEDIA_FILE} \
+    --ingredient-manifest-store ${downloaded_manifest} \
+    --output re_signed_image.jpg \
+    --assertions-inline '{
+        "assertions": [
+          {
+            "label": "c2pa.actions",
+            "data": {
+              "actions": [
+                {
+                  "action": "c2pa.unknown",
+                  "when": "@now",
+                  "parameters": {
+                    "description": "Some unknown edits have been made between watermarking and now."
+                  }
+                }
+              ]
+            }
+          }
+        ]
+      }' > /dev/null 2>&1
+echo " --> re_signed_image.jpg"
+rm -f ${downloaded_manifest}
+
+echo
+echo "Checking the manifest..."
+${TRUEPIC_CLI} verify re_signed_image.jpg | jq