jpegtrust — Rust crate

A Rust library and CLI for embedding, extracting, and verifying JPEG Trust provenance metadata. A faithful, binary-compatible port of the Python package.

⇵
Embed & extract
Inject provenance metadata into JPEG and PNG images via JUMBF, and read it back out — byte-for-byte compatible with the Python tool.
✓
Verify
Validate images against configurable trust profiles with the same json-formula expression engine and scoring as the reference implementation.
☰
Profiles & templates
Build trust profiles from built-in templates (newsroom, insurance, creator, ai-labelling) or pick individual checks.
⚡
Native & dependency-light
A pure-Rust core with no C dependencies for the default build. Optional crypto feature adds X.509 trust-list validation.

Requirements

Rust ≥ 1.74 (edition 2021)
Dependencies serde, serde_json, serde_yaml, clap, sha2
License MIT
Version 0.1.0

Installation

Add the crate to your Cargo.toml from crates.io:

cargo
cargo add jpegtrust

Or build the CLI binary from source:

from source
git clone https://github.com/jpeg-trust/jpegtrust.git
cd jpegtrust/rust_package
cargo build --release
./target/release/jpegtrust --help

Quick start

A complete workflow — create a trust profile, embed metadata, and verify against it:

Rust
use jpegtrust::{create_profile, save_profile, embed_image, verify_image};

fn main() -> jpegtrust::Result<()> {
    // 1. Create a trust profile from a template
    let profile = create_profile(
        "newsroom",            // template
        "Wire Photo Policy",    // name
        "My News Agency",       // issuer
        None,                    // explicit check ids (override template)
        "en",                   // language
    )?;
    save_profile(&profile, "policy.yml")?;

    // 2. Embed metadata into a JPEG image
    embed_image("photo.jpg", "metadata.json", "signed.jpg", None)?;

    // 3. Verify the image against the profile
    let report = verify_image("signed.jpg", "policy.yml")?;

    println!("{}", report.status.as_str()); // "pass" | "warning" | "fail"
    println!("{}", report.score);            // 0.0 to 1.0
    println!("{}", report.verdict);          // "trusted" | "mostly_trusted" | ...
    println!("{:?}", report.passed);         // ["copyright", "edit_history", ...]
    Ok(())
}

Or use the command line — the same subcommands as the Python CLI:

CLI
# Create a profile
jpegtrust profile create --template newsroom --name "Wire Photo Policy" -o policy.yml

# Embed metadata
jpegtrust embed photo.jpg metadata.json -o signed.jpg

# Verify
jpegtrust verify signed.jpg policy.yml

# Get JSON output for pipelines
jpegtrust verify signed.jpg policy.yml --format json

What's in the crate

Module Functions Description
jpegtrust::embed embed_image, embed_image_value, embed_metadata Inject metadata into JPEGs / PNGs
jpegtrust::extract extract_from_file, extract_metadata Read metadata from images
jpegtrust::verify verify, verify_image, report_to_assertion Validate against trust profiles
jpegtrust::profile create_profile, load_profile, save_profile, ... Create and manage trust profiles
jpegtrust::batch batch_embed, batch_extract, batch_verify Bulk operations on directories
jpegtrust::iptc IPTC_DIGITAL_SOURCE_TYPES, is_ai_generated, ... IPTC digital source type helpers
jpegtrust::privacy redact_assertions, obfuscate_field Assertion redaction & obfuscation
jpegtrust::crypto validate_certificate_chain, ... (feature = "crypto") X.509 trust-list validation (optional)

Cargo features

Feature Default Description
cli on Builds the jpegtrust command-line binary (pulls in clap).
crypto off X.509 certificate-chain validation and trust-list management.

Available templates

Templates are pre-built sets of trust checks. The same five templates as the Python package:

Template Checks Best for
newsroom all 13 Wire photos, editorial verification
insurance 6 Claims photo validation with GPS
creator 8 Artist authenticity and rights
ai-labelling 7 AI-generated content labelling (incl. IPTC digital source type)
custom 0 Pick your own checks

Compatibility with the Python package

The Rust crate is a faithful port and is interoperable with the Python implementation:

  • The JUMBF box layout, APP11 segmentation, and PNG juMb chunk handling are byte-for-byte compatible — an image embedded by one tool is read by the other.
  • The json-formula evaluator supports the same expression subset (dot/quoted access, indexing, ==/!=, &&/||, != null, contains(), keys(), @).
  • Verification produces identical scores and verdicts for the same indicator and profile.

How it works

jpegtrust workflow
Embed
JPEG + JSON metadata
↓
embed_image()
↓
JPEG with JUMBF data
Extract
Embedded JPEG
↓
extract_from_file()
↓
serde_json::Value
Verify
JPEG + trust profile
↓
verify_image()
↓
VerificationReport

Next steps