內容簡介
Tracefern Media Check for Content Credentials (C2PA) 外掛可驗證上傳媒體檔案的內容憑證，確保檔案的真實性與來源，並提供即時的驗證結果，讓使用者能夠輕鬆管理媒體內容的可信度。
【主要功能】
• 驗證媒體檔案的內容憑證
• 檢查檔案簽名與哈希值
• 提供即時驗證結果於媒體庫
• 支援多種檔案格式如 JPEG、PNG 等
• 背景運行，不影響檔案上傳
• 可依據驗證結果進行排序與篩選
外掛標籤
開發者團隊
② 後台搜尋「Tracefern Media Check for Content Credentials (C2PA)」→ 直接安裝（推薦）
📦 歷史版本下載
原文外掛簡介
Verified, not just detected. Finding a C2PA manifest in a file is
easy; knowing whether it is genuine is not. A manifest can be copied onto
another image, and an image can be changed after it was signed while its
manifest still claims what it did before. Tracefern checks the signature,
the hash that ties the manifest to the image’s own bytes, and the signer’s
certificate against the C2PA trust lists. Only when the signature and the
hash hold does it show “AI-generated (signed)”, and only when the signer
is also on the trust list does it say “Verified”.
Content Credentials (C2PA) are a signed record inside a file: who
made or edited it, with which tool, and whether generative AI was used.
Tracefern verifies that record for every JPEG, PNG, GIF, WebP, WAV,
MP3, FLAC and plain text you upload and shows the verdict where you already work with media.
Checked right after upload, on the original file, not on the
resized copies WordPress or your browser makes. The check runs in the
background, so a file that trips it up can never break an upload.
A verdict per file in a Media Library column and in the attachment
details: who signed it, when, and against which trust list.
“AI-generated (signed)” when a manifest that verifies says the image
was made by generative AI, also after later edits, and “AI-edited
(signed)” when AI edited it. Never on a file that does not verify.
Sort and filter by verdict, AI-generated included, and see the
counts on the dashboard.
Check existing files again under Settings → Tracefern or with WP-CLI.
The verdicts:
Verified: trusted signer — the credentials verify and the signer’s
certificate chains to a trusted certificate authority.
Intact: signer not trusted — the credentials verify, but the signer
is not on the trust list. The file is unchanged since signing; who
signed it is not vouched for.
Does not verify — something failed, for example the image was
changed after signing. The details list the C2PA status codes.
No Content Credentials — the file carries none. Most images today.
Could not be checked — the file could not be read or the check did
not finish. The upload always proceeds.
What it does not do:
It never signs anything and holds no keys.
It never blocks an upload.
It makes no network calls of its own. When another plugin has moved the
original image to cloud storage, the image is read through that plugin,
once per check. A manifest that is only referenced by URL is not
fetched, and trust lists are never downloaded.
Verification is done by
provemark/c2pa-verifier, a
C2PA verifier written in PHP, bundled with the plugin.
Development
The source code, the tests and the build are public at
https://github.com/provemark/tracefern-image-check. composer build makes the
plugin’s zip from it: it installs the bundled verifier and prefixes its
namespace with Strauss, so it cannot collide with another copy. The
verifier itself is developed at https://github.com/provemark/c2pa-verifier.
Trust lists
By default the plugin trusts the certificate authorities on the C2PA
conformance programme’s trust lists, bundled with the plugin, and,
optionally, the DigiCert
Trusted Root G4 for timestamps. Settings → Tracefern shows the date of the
bundled copy and lets an administrator replace the lists with their own
trust settings. The plugin never downloads a list; a new copy comes with a
plugin update.
The C2PA trust lists are © the Coalition for Content Provenance and
Authenticity (C2PA), from https://github.com/c2pa-org/conformance-public,
licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
