Provenance
Trace the claims attached to a file.
Content Credentials (C2PA) let cameras, phones and editing tools attach cryptographically signed claims about a file's origin and history. Syft reads them and reports exactly what it finds, no more and no less.
The credential read
What a credential actually is.
A Content Credential is a signed chain, and Syft reads it link by link, as evidence and never as a verdict.
- Claim: what the capturing or editing tool asserts happened
- Signature: who signed that claim, and whether it verifies
- Ingredients: the earlier files this one was made from
- Validation: does the chain still match these exact bytes
The file carries signed claims: what captured it, what edited it, with which tools. Syft shows the chain as the credentials state it.
This is the common case today: most files have never been near a credential-writing tool. Syft reports the absence as a fact about the file, not a mark against it.
Claims are present but do not validate cleanly, perhaps a broken signature or a truncated chain. Syft names the specific failure instead of rounding to a verdict.
What absence tells you
Credentials are young. A genuine photograph from a 2019 camera, a real document from ordinary software: neither carries them. Absence tells you there is nothing attached to verify, and nothing more.
What a valid credential proves
A valid credential proves the claims were signed by the stated tool and unaltered since. It does not prove the content of the file is true, fair or complete. Syft presents provenance as one layer of evidence among five.