SignUnder Open-Sources Its C2PA Signing Stack for AI Content Labels

C2PA signing goes open source with SignUnder

SignUnder released its entire production codebase for AI content labeling on GitHub on October 20, 2026, under the Apache-2.0 license. The release, at AivaStack/signunder, includes the API, the C2PA signer, watermark and fingerprint workers, the rules engine, and SDKs for .NET and Python. In plain terms, a company that sells a service for marking AI-generated images has published the code that does the marking, so developers can inspect exactly how it works.

That matters because content labeling is moving from a nice idea to a legal requirement. Regulations like the EU AI Act push platforms and creators to label AI-generated content, but labels only help if people trust them. A closed labeling service asks for trust. An open codebase lets anyone verify the claim, which is a stronger position, especially when the label is supposed to survive in a world of screenshots, re-uploads, and metadata stripping.

What the C2PA signing stack includes

The stack is polyglot and pragmatic. A .NET 10 API handles signing, verification, and registry management. A Rust gRPC service wraps c2pa-rs for manifest creation. A Python worker handles invisible TrustMark watermarks and PDQ perceptual hashing, which is designed to survive metadata stripping by identifying content from its pixels rather than its file headers. The rules engine ships with eight pre-configured packs covering jurisdictions including the EU, California, China, South Korea, India, and New York.

Developers can run the full service locally with Docker via make up, but local testing uses a development certificate that standard Content Credentials viewers do not recognize. Production-grade signing requires a key in a KMS or HSM and a certificate from a certificate authority that has passed the C2PA conformance program. Current support is limited to JPEG, PNG, and WebP images, and watermark robustness against aggressive cropping is still under evaluation. Those limits are stated openly, which is itself a reason to take the release seriously.

Why open source matters for trust infrastructure

Content credentials are trust infrastructure, and trust infrastructure ages badly when it is opaque. If a labeling system has a flaw, that flaw affects every image it touched. Publishing the code does not fix flaws by itself, but it lets independent researchers find them, and it lets competitors and regulators compare implementations instead of comparing marketing claims. That is the same logic that made open source the default for cryptography, and it applies here too.

There is also a practical benefit for developers building AI features. Instead of integrating a black-box labeling API and hoping its output matches what regulators expect in each jurisdiction, teams can run the rules engine locally, test against the eight jurisdiction packs, and see exactly which rules fire for a given image. That reduces the compliance guesswork that usually comes with shipping AI features across borders.

What to watch and what to try

If you build with AI-generated images, the useful test is not whether SignUnder's code compiles. It is whether a labeled image survives the journey your users actually put it through: download, screenshot, re-upload, crop, compress. Try the Docker setup, sign a test image, strip its metadata, and see what a Content Credentials viewer still recognizes. If the watermark and perceptual hash hold up, that is a real result. If they do not, you have learned the limits before your users do.

The wider context is a developer ecosystem moving toward verifiable AI output. Git 2.56 shipped cleaner commit handling for agent-driven workflows, TypeScript 7.1 beta arrived for toolchains waiting on it, and Chrome DevTools MCP added tools for AI coding agents. SignUnder fits that pattern: tools that make AI work auditable, not just faster. Open code will not settle the debate about AI labels, but it gives the debate something concrete to argue about.