jpegtrust — Rust crate
A Rust library and CLI for embedding, extracting, and verifying JPEG Trust provenance metadata. A faithful, binary-compatible port of the Python package.
Embed & extract
Inject provenance metadata into JPEG and PNG images via JUMBF, and read it back out — byte-for-byte compatible with the Python tool.
Verify
Validate images against configurable trust profiles with the same json-formula expression engine and scoring as the reference implementation.
Profiles & templates
Build trust profiles from built-in templates (newsroom, insurance, creator, ai-labelling) or pick individual checks.
Native & dependency-light
A pure-Rust core with no C dependencies for the default build. Optional
crypto feature adds X.509 trust-list validation.Requirements
Rust ≥ 1.74 (edition 2021)
Dependencies serde, serde_json, serde_yaml, clap, sha2
License MIT
Version 0.1.0
Installation
Add the crate to your Cargo.toml from crates.io:
cargo
cargo add jpegtrust
Or build the CLI binary from source:
from source
git clone https://github.com/jpeg-trust/jpegtrust.git
cd jpegtrust/rust_package
cargo build --release
./target/release/jpegtrust --helpQuick start
A complete workflow — create a trust profile, embed metadata, and verify against it:
Rust
use jpegtrust::{create_profile, save_profile, embed_image, verify_image}; fn main() -> jpegtrust::Result<()> { // 1. Create a trust profile from a template let profile = create_profile( "newsroom", // template "Wire Photo Policy", // name "My News Agency", // issuer None, // explicit check ids (override template) "en", // language )?; save_profile(&profile, "policy.yml")?; // 2. Embed metadata into a JPEG image embed_image("photo.jpg", "metadata.json", "signed.jpg", None)?; // 3. Verify the image against the profile let report = verify_image("signed.jpg", "policy.yml")?; println!("{}", report.status.as_str()); // "pass" | "warning" | "fail" println!("{}", report.score); // 0.0 to 1.0 println!("{}", report.verdict); // "trusted" | "mostly_trusted" | ... println!("{:?}", report.passed); // ["copyright", "edit_history", ...] Ok(()) }
Or use the command line — the same subcommands as the Python CLI:
CLI
# Create a profile jpegtrust profile create --template newsroom --name "Wire Photo Policy" -o policy.yml # Embed metadata jpegtrust embed photo.jpg metadata.json -o signed.jpg # Verify jpegtrust verify signed.jpg policy.yml # Get JSON output for pipelines jpegtrust verify signed.jpg policy.yml --format json
What's in the crate
Module Functions Description
jpegtrust::embed embed_image, embed_image_value, embed_metadata Inject metadata into JPEGs / PNGs
jpegtrust::extract extract_from_file, extract_metadata Read metadata from images
jpegtrust::verify verify, verify_image, report_to_assertion Validate against trust profiles
jpegtrust::profile create_profile, load_profile, save_profile, ... Create and manage trust profiles
jpegtrust::batch batch_embed, batch_extract, batch_verify Bulk operations on directories
jpegtrust::iptc IPTC_DIGITAL_SOURCE_TYPES, is_ai_generated, ... IPTC digital source type helpers
jpegtrust::privacy redact_assertions, obfuscate_field Assertion redaction & obfuscation
jpegtrust::crypto validate_certificate_chain, ... (feature = "crypto") X.509 trust-list validation (optional)
Cargo features
Feature Default Description
cli on Builds the
jpegtrust command-line binary (pulls in clap).crypto off X.509 certificate-chain validation and trust-list management.
Available templates
Templates are pre-built sets of trust checks. The same five templates as the Python package:
Template Checks Best for
newsroom all 13 Wire photos, editorial verification
insurance 6 Claims photo validation with GPS
creator 8 Artist authenticity and rights
ai-labelling 7 AI-generated content labelling (incl. IPTC digital source type)
custom 0 Pick your own checks
Compatibility with the Python package
The Rust crate is a faithful port and is interoperable with the Python implementation:
- The JUMBF box layout, APP11 segmentation, and PNG
juMbchunk handling are byte-for-byte compatible — an image embedded by one tool is read by the other. - The json-formula evaluator supports the same expression subset (dot/quoted access, indexing,
==/!=,&&/||,!= null,contains(),keys(),@). - Verification produces identical scores and verdicts for the same indicator and profile.
How it works
jpegtrust workflow
Embed
JPEG + JSON metadata
↓
embed_image()
↓
JPEG with JUMBF data
Extract
Embedded JPEG
↓
extract_from_file()
↓
serde_json::Value
Verify
JPEG + trust profile
↓
verify_image()
↓
VerificationReport