Missing Content Credentials versus an unreadable manifest

Use controls with known storage

The public exercise uses three self-authored PNGs. unsigned.png has a readable synthetic claim but no signature; absent.png has no supported store; unreadable.png contains caBX storage with deliberately unreadable bytes. None is a signed provenance certificate. The reference readings below were produced by the actual bounded reader and report builder.

For signed-store interoperability, obtain the original C.jpg and CA.jpg from the fixed upstream links. These external files contain signature boxes; this site does not mirror them or claim to validate their signatures. Keep their hashes with the downloaded originals so a changed download is not silently treated as the same reference.

• Download the explicitly unsigned credential-reading example — Self-authored 534-byte, 1 × 1 PNG with one readable synthetic claim and c2pa.created action. No signature box, certificate trust or valid signed credential is claimed.
• Download the absent-store control — Self-authored 68-byte PNG containing IHDR, IDAT and IEND, with no caBX or embedded C2PA store in the supported locations.
• Download the present-but-unreadable store control — The absent PNG plus a valid-CRC caBX chunk whose three payload bytes are deliberately not a readable manifest. Image-container validity and manifest readability are separate.
• Official C.jpg at c2pa-rs revision 60f7cbdc69ab — Upstream reference, not mirrored here. SHA-256 a2d14755db55de67a47c04090340d8266e892367be4104a45626d7a6fa6e9ffd; one APP11 packet, a 45,872-byte store, c2pa.created and a signature box. Reading is not verification.
• Official multi-packet CA.jpg at the same fixed revision — Upstream original, not mirrored. SHA-256 e71bff58fc57640803e6e65f7534e2fb0c2f99018c85276cc14b30f04427cc76; two APP11 packets reassemble a 117,241-byte store; c2pa.opened and c2pa.color_adjustments were read.

Read and export each distinct state

1. Step 1

   Read the unsigned claim

   Open the C2PA checker and choose unsigned.png, or click Try synthetic credential sample. The reference result is manifest_read with one readable claim and one Created action. Signature-box presence is false. Readable stored text does not turn this explicitly unsigned fixture into a valid credential.

   Open the local C2PA reader

2. Step 2

   Compare missing storage with unreadable storage

   Choose absent.png and then unreadable.png. The former is absent in supported JPEG APP11/PNG caBX locations. The latter is present_unreadable with zero readable manifests. Do not replace either the unreadable status or its warnings with no credentials found.

3. Step 3

   Review the complete report before downloading

   Open Export this reading · not verified. Leave stored declarations excluded for the minimal report. Use Complete report preview to inspect JSON or Markdown, then Download reading JSON or Download reading Markdown. The report includes the original SHA-256, byte length, real read status and explicit not_verified values; the original filename is omitted.

Keep a small result table

All three verification flags remain false: signature, certificate trust and asset binding. Even a stored signer name or AI source-type assertion is a declaration returned by a limited reader. It is not a conclusion about who made the image or whether the pixels are generated.

Stop at a real failure instead of inventing absence

Unsupported WebP storage, a damaged image container, a processing limit and present-but-unreadable storage have separate report statuses. A size limit does not provide a no-store result, and a filename containing C2PA is not a store. The reader does not fetch remote manifest references or execute stored URLs/actions.

For a cryptographic decision, preserve the exact original and use an independent validator capable of checking signatures, trust and binding. Record its tool/version and actual output separately. This local report is a reading record, so its not-verified statement belongs with every shared export.

• C2PA Technical Specification 2.2, May 2025 — Fixed primary reference for manifest storage, assertions, actions and validation concepts. This reader implements bounded storage/claim reading, not the cryptographic validation procedures.
• Choose a broader verification path — The existing guide explains independent validation and how to interpret provenance evidence.

Sources and reproducible inputs

• Download the explicitly unsigned credential-reading example — Self-authored 534-byte, 1 × 1 PNG with one readable synthetic claim and c2pa.created action. No signature box, certificate trust or valid signed credential is claimed.
• Download the absent-store control — Self-authored 68-byte PNG containing IHDR, IDAT and IEND, with no caBX or embedded C2PA store in the supported locations.
• Download the present-but-unreadable store control — The absent PNG plus a valid-CRC caBX chunk whose three payload bytes are deliberately not a readable manifest. Image-container validity and manifest readability are separate.
• Official C.jpg at c2pa-rs revision 60f7cbdc69ab — Upstream reference, not mirrored here. SHA-256 a2d14755db55de67a47c04090340d8266e892367be4104a45626d7a6fa6e9ffd; one APP11 packet, a 45,872-byte store, c2pa.created and a signature box. Reading is not verification.
• Official multi-packet CA.jpg at the same fixed revision — Upstream original, not mirrored. SHA-256 e71bff58fc57640803e6e65f7534e2fb0c2f99018c85276cc14b30f04427cc76; two APP11 packets reassemble a 117,241-byte store; c2pa.opened and c2pa.color_adjustments were read.
• C2PA Technical Specification 2.2, May 2025 — Fixed primary reference for manifest storage, assertions, actions and validation concepts. This reader implements bounded storage/claim reading, not the cryptographic validation procedures.