JAZ-X Media Provenance Inspector

JAZ-X Media Provenance Inspector helps WordPress administrators inventory media provenance and inspect C2PA metadata and credentials.

This is an independent plugin by JAZ-X Innovation. It is not affiliated with or endorsed by the Coalition for Content Provenance and Authenticity (C2PA) or the Content Authenticity Initiative.

Core features:

• SHA-256 hashing of original media and generated image sizes.

• Original and derivative inventory in dedicated database tables.

• C2PA marker detection separated from generic JUMBF-only metadata.

• Credential-loss warnings when a C2PA-bearing original produces WordPress derivatives that no longer contain the original credential marker.

• Browser-side cryptographic C2PA verification using a locally bundled SDK and WebAssembly runtime.

• Validation states for Trusted, Valid / untrusted, Invalid, No valid manifest, and Verification error. Trusted may remain visible on stored results produced with a previously configured trust source.

• Human-readable explanations for common integrity and trust findings.

• Manifest label/title, claim generator, signer, issuer, signature time, and validation-code capture where supplied by the verifier.

• Media Library status column and an administrator-only JAZ-X Media Provenance Inspector dashboard.

• Large-library scanning in safe 50-item AJAX batches with Pause/Resume and refresh-safe state.

• JFIF/JPE support as part of the JPEG family.

• Separate Unsupported, Missing source, Scan error, and Other JUMBF classifications.

1 and its matching WASM runtime inside the plugin. It does not load third-party executable JavaScript or WASM for cryptographic verification.

Media bytes are fetched from the same WordPress origin and processed in the administrator’s browser. JAZ-X Media Provenance Inspector does not upload media bytes to any JAZ-X service. Cross-origin attachment URLs (for example, some CDN/offload configurations) are not fetched by the verifier in this release.

Remote manifest fetching, OCSP lookups, and external trust-list requests are disabled in this release. Local integrity verification remains fully available without an external verification-data request.

Third-party code and source

JAZ-X Media Provenance Inspector includes GPL-compatible third-party dependencies under vendor/c2pa/. txt and vendor/c2pa/licenses/.

The bundled C2PA browser runtime is built from:

• @contentauth/c2pa-web 0.15.1 — MIT license

• @contentauth/c2pa-wasm 0.13.0 — MIT license

• @contentauth/c2pa-types 0.7.4 — MIT license

• @contentauth/c2pa-utilities 0.3.0 — MIT license

• highgain 0.1.0 — ISC license

Upstream C2PA source code:

com/contentauth/c2pa-js

Highgain package distribution:

0

js is the small readable ESM distribution from that package; its package metadata and ISC license are included alongside it.

js path. The local index file points to that renamed runtime chunk. txt.

Reproduction outline:

• Install Node.js and npm.

• Run npm install @contentauth/[email protected] [email protected].

• Copy the package’s dist/index.js, runtime chunk, worker, and dist/resources/c2pa_bg.wasm into vendor/c2pa/.

• Rewrite the runtime’s bare highgain import to./highgain.js, rewrite the index runtime import to the local renamed chunk, and use c2pa-web.bundle.js as the small JAZ-X Media Provenance Inspector entry module.