# Signer trust

Declawd checks the selected file's active manifest against a local snapshot of the official C2PA signer list. The snapshot contains 32 certificates, is copied unchanged from `c2pa-org/conformance-public` commit `295f13bf4d8f483046f13a32a808a7ca3b1742f9`, and has SHA-256 `b3949271a07b007e92ef1d18050b55388f5e0d2686a16fd864176c48421af8ae`. Its source, dates, attribution and scope are recorded in `trust/policy.json`. The source repository's CC BY 4.0 licence is included in `trust/LICENSE.txt` and the built licence notices.

## Scope

A trusted result means the SDK returned `signingCredential.trusted` for the active manifest under this snapshot. A credential failure takes precedence over a positive status. Ingredient results remain scoped to their ingredients. An absent status remains unavailable. Content binding and cryptographic signature results stay separate, including when the signer is trusted.

The policy configures no extra user anchors, certificate allow list or test certificate exceptions. The existing self-signed Declawd fixtures therefore report untrusted. The CAWG identity trust list is disabled. A signer chain result does not establish a claim's truth, the identity of a text's author or approval of Declawd as a conforming validator.

Online certificate status, timestamp authority trust and remote manifest retrieval are unavailable. The SDK settings disable those requests and timestamp trust checks. The worker also rejects fetches and receives a CSP with `connect-src 'none'`. The page obtains the pinned PEM bytes from its application bundle, with no runtime request for trust material.

## Lifetime

The snapshot was reviewed on 29 October 2026 and expires at 00:00 UTC on 28 November 2026, earlier than the source list's next update on 21 January 2027. The build checks its SHA-256, certificate count, CA constraints and duplicate certificates, and refuses an expired policy. An already built page withholds signer trust before the review date or at and after expiry. Binding and signature checks remain available, with the stale trust result explicitly unavailable.

A refresh requires a pull request that reviews the official list, records its exact source commit, updates the local PEM and policy hashes and dates, and reruns the trust, receipt and browser checks. The browser does not update the list automatically. Removing or adding an authority changes the policy and its recorded snapshot. Existing receipts retain the snapshot and settings used for their inspection.

## Receipt

Each receipt includes the policy identifier, source commit, PEM hash, review and expiry dates, snapshot currency, SDK settings and checker build identity. The trust result describes this snapshot. Current revocation, timestamp trust and remote record availability have their own unavailable results.

The source list and its role are documented in the [C2PA Conformance Program repository](https://github.com/c2pa-org/conformance-public/tree/295f13bf4d8f483046f13a32a808a7ca3b1742f9/trust-list) and the [SDK trust instructions](https://opensource.contentauthenticity.org/docs/c2patool/docs/usage/#using-the-official-c2pa-trust-list).