Content Credentials Are a Nutrition Label
Valentijn opened with a can of cola.
"Imagine that this nutrition label contains all the ingredients that go into your Coke. Content credentials are exactly the same, but this time it is for a digital product."
The comparison carries further than it looks. Every line item on a physical label simply sits there. In C2PA, every line item has an owner and a signature behind it:
- An ingredient becomes an assertion: a Sony camera recorded this, Adobe Premiere edited that.
- The most important line is the identity of the publisher, saying this is my video, I am WDR, I am the BBC. That gives the content an identity, and, as Valentijn put it, if you have a problem with it, you now know the number to call.
- Every signature is bound to the exact bytes it covers. Flip a pixel or change a word, and the assertion turns invalid.
Where Live Breaks It
A can of cola has a beginning and an end. Live video has neither, and that single difference opens three gaps.
Provenance has to change over time. A news broadcast going into a commercial break holds the news, commercial one, commercial two, a bumper, then the news again: five items and four identities inside one continuous stream. A single static manifest cannot follow a timeline that keeps changing underneath it.
Most of the production chain is still catching up. Some cameras produce C2PA today, while many recorders, encoders and storage systems do far less. Anyone starting now begins where only part of the chain speaks the language, and still needs the identity on the output.
The compliance clock is running. Under the EU AI Act's Article 50 transparency obligations, content generated with an AI system, whether subtitles, colour correction or a complete advertisement, has to be marked visually from August 2, and machine-readably inside the file itself from December 2. The European Commission has published its guidance on those obligations. That second deadline turns provenance from an interesting idea into a delivery requirement.
AIX: Provenance That Follows the Timeline
Unified Streaming's answer is AIX, the Authenticity Information Exchange: a document description that tells the packager, at the edge and just before content reaches the viewer, which C2PA information applies right now.
The design lets operators begin where they are. A static file against Unified Origin gives you one manifest for everything you broadcast, enough to say "I am WDR" on every segment you ship. Point the packager at an AIX endpoint wired into playout, and the manifest starts following the schedule: the advertiser carries its own identity, the programme carries its own, and your broadcaster claim stays constant across all of it.
The same interface also filters. Asked by Martin Grohme about virtual channels assembled from VOD files that already carry credentials, Valentijn described the packager asking AIX what to do with the provenance it found: pass it through, add to it, or leave parts out. That covers a question the industry has circled since last IBC, where a broadcaster with a camera operator somewhere dangerous wants to publish its own identity and stop the chain there.
Valentijn confirmed AIX gets published openly within days, then goes to the C2PA organization itself. And on where all of this is heading:
"If you want to see the future of C2PA, look at DRM."
Nicolás picked up the parallel: AIX sitting alongside DRM's CPIX, one interface for content protection and one for content authenticity, both feeding the same packager.
What Qualabs Contributed
Pablo framed where the ecosystem stood when this work started. Three pieces were already mature and in production, and all three were built for files.
| Project | What it is | State for live |
|---|---|---|
| c2pa-rs | The official Rust SDK | Complete for VOD |
| Common Media Library | Shared TypeScript library for playback | Complete for VOD |
| dash.js | Reference DASH player | Complete for VOD |
Qualabs made three contributions upstream, each to a project we do not own, plus a toolkit of our own that ties them together. Both signing methods in the spec are implemented, so operators can choose.
| Method | Where the manifest goes | How segments are signed |
|---|---|---|
| Per-segment manifest | Full manifest store in the UUID box of every segment | Each segment stands on its own |
| Verifiable segment info | Full manifest store in the UUID box of the init segment | A session key signs each segment, signature in the emsg box |
Where the code lives:
- @svta/cml-c2pa, the validation core, merged and released. Both live methods plus VOD, where fragmented content binds through a Merkle tree rather than per-segment signatures. It answers one question, whether a segment is valid, and remembers nothing, which is what keeps it reusable across any player.
- dash.js pull/5102, C2PA validation as an optional feature, awaiting review. With the flag off nothing is parsed, one line of configuration turns it on, and what the viewer sees stays your call.
- c2pa-rs issues/2507 and pull/2562, live signing and validation, awaiting review.
The c2pa-rs story
Worth telling, because it says something about how upstream collaboration works. Qualabs opened a feature request and two pull requests in March, and the work sat still. The blocker had nothing to do with code quality: nobody upstream was able to run or test live video. Adobe proposed that Qualabs maintain the feature, we agreed, and at the time there was no mechanism for anyone outside the Content Authenticity Initiative team to maintain code in that repository.
In July, Adobe created exactly that mechanism, experimental features, and pointed us at it the day it existed. The feature lives in the c2pa-rs tree outside its normal stability commitments, off by default behind an unstable cargo flag, absent from the binary entirely when disabled, with day-to-day support belonging to us. Building it yourself is the way to get it, since a standard c2pa-tool release leaves it out. As far as we know, Qualabs is the first contributor from outside to walk that path.
Break your own stream
The c2pa-live-video-toolkit ships a signer, plugins for dash.js, hls.js and video.js, a demo player at c2pa-player.qualabs.dev, and an attack proxy. The proxy drops, reorders, replays and swaps segments while leaving the manifest untouched, each attack designed to trip a different failure. Run it and watch validated segments turn from green to invalid in real time. A validator that only ever reports success teaches you very little.
The whole implementation was then tested against Unified Streaming's, over several weeks, carrying WDR broadcast content. Two independent readings of the same spec, talking to each other.
What comes next
- Trust lists in the Common Media Library, so a validator reports whether a segment is trustworthy rather than merely valid. Checking hash and signature proves the content is intact; knowing who signed it turns that into trust.
- Time stamping and revocation after that.
- Merging the c2pa-rs and dash.js pull requests, then supporting them.
See It Running at IBC2026
EBU booth, throughout IBC2026: live feeds from WDR and CBC/Radio-Canada plus a Sony camera on the floor. Unified Streaming adds the content credentials and broadcaster identity at the packager, and two players validate in real time, one from WDR/ARD and one from EBU/Security for Media. Neither player belongs to Qualabs, and both run the implementation we contributed, which is the outcome we were aiming for.
Emil Santurio is at the booth with Valentijn, and speaking at the C2PA and open source meetups there on Saturday 12. Unified Streaming booth: a further demo, using our validator.
Bring Us Your Feedback
Getting C2PA into production is a community effort, and we are at the first steps of it. The whole point of contributing to libraries we do not own is that other people use them. So try any of it, with whichever player you run, and tell us what happens. Bugs, gaps, ideas, requirements we have yet to consider: all of it is welcome. Reach out to Pablo Flores, or find us at IBC2026.
