Validate C2PA credentials before attribution

tests/conftest.py

@@ -2,7 +2,9 @@
 
 from __future__ import annotations
 
-from typing import TYPE_CHECKING
+import struct
+import zlib
+from pathlib import Path
 
 import cv2
 import numpy as np
@@ -10,9 +12,6 @@ import pytest
 from PIL import Image
 from PIL.PngImagePlugin import PngInfo
 
-if TYPE_CHECKING:
-    from pathlib import Path
-
 
 @pytest.fixture
 def clean_photo(tmp_path: Path) -> Path:
@@ -76,3 +75,22 @@ def tmp_clean_png(tmp_path: Path) -> Path:
     path = tmp_path / "clean.png"
     img.save(path, pnginfo=pnginfo)
     return path
+
+
+@pytest.fixture
+def tampered_chatgpt_png(tmp_path: Path) -> Path:
+    """Add valid PNG metadata after signing so the C2PA asset hash no longer matches."""
+    source = Path(__file__).resolve().parents[1] / "data" / "fixtures" / "provenance" / "chatgpt-1.png"
+    data = source.read_bytes()
+    iend = data.rfind(b"\x00\x00\x00\x00IEND")
+    assert iend >= 0
+
+    kind = b"tEXt"
+    payload = b"c2pa-test\x00benign post-signing metadata mutation"
+    chunk = (
+        struct.pack(">I", len(payload)) + kind + payload + struct.pack(">I", zlib.crc32(kind + payload) & 0xFFFFFFFF)
+    )
+    target = tmp_path / "tampered-chatgpt.png"
+    target.write_bytes(data[:iend] + chunk + data[iend:])
+    assert target.read_bytes() != data
+    return target