Open-source C2PA signing: SignUnder's code is on GitHub

What is in the repository?

• The API (.NET 10): signing, verification, the registry of signed outputs, accounts and the public verify routes.
• The signer (Rust), a thin service around c2pa-rs, the C2PA reference implementation, pinned to an exact version so the manifests it writes do not drift. It signs through a cloud KMS, and can add a CAWG identity assertion naming the company that publishes the content.
• The watermark and fingerprint worker (Python): an invisible TrustMark watermark bound into each manifest, and a PDQ perceptual hash, so an output can still be recognised after a platform strips its metadata.
• The rules engine and eight rule packs: EU Article 50, the Code of Practice, California, mainland China, South Korea, India, New York and the platforms' labelling rules. Every rule cites its primary source and the date it was read; the free checker runs on them.
• The architecture and every technical decision, as decision records, and the evidence prepared for the C2PA conformance program.

Why open it?

A signature on AI-generated content is a claim about where the content came from, and the rules that decide which marks a company needs are a reading of the law. Both are easier to trust when anyone can read how they are made: what the manifest says, what the watermark carries, which source each rule rests on. Opening the code also lets a company check exactly what runs on its behalf, or run it itself.

Can I run it myself?

Yes. make up starts the whole service in Docker, signing with a development key and certificate that are committed for the purpose; the repository's README has the steps. Content signed that way is valid but shows as unrecognised in Content Credentials viewers, because the development certificate is not on the C2PA trust list. Recognised signing in your own name needs two things the code cannot supply: your key in a KMS or HSM, and a certificate from a certificate authority on that list, issued once your product passes the C2PA conformance program. The own-name guide explains why that name cannot be delegated.

What does the hosted service add?

The keys held in an HSM, the conformance listing and certificate, the public verify page for each company, the identity checks behind the "verified by SignUnder" line, and rule packs kept current against their sources every week. The code is the same; the hosted service is the operation around it. The docs show how to start.