What is signed and what is not
Original versus output, the tags in the downloads drawer — and which download is recorded.
The „Downloads“ drawer in the editor header counts the original: „Downloads (3)“ means two outputs plus the source file. The „Original“ row always comes first, even before any output exists.
The description under the title states the split in one sentence: „Original und gespeicherte Derivate dieses Assets — Derivate sind C2PA-signiert, das Original bleibt unverändert.“ (Original and saved derivatives of this asset — derivatives are C2PA-signed, the original stays unchanged.)
The signed-in product speaks German, so its labels are quoted in German throughout, with the English rendering in italics.
The original goes back as it came
The download delivers exactly the file you uploaded — no verstag signature, no label.
But: if the uploaded file already carried a foreign manifest, it is still in there. The row says so with its tags:
| Tag | When |
|---|---|
| „ohne Label“ (no label) | always — the original never carries a burnt-in marking |
| „enthält Manifest“ (contains a manifest) | verification found Content Credentials |
| „ohne Signatur“ (unsigned) | verification found none |
The tags show the verification result. Where the asset has not been verified yet, the row reads „ohne Signatur“ and offers no manifest — verify it to see the actual result.
The menu entry „Content Credentials (JSON)“ appears on the original row only where a manifest was found.
Signing happens at render time
The output is signed while rendering; the download signs nothing further, it only checks and hands the file out.
The signing time and the certificate's serial number then sit on the output, and an event „Signiert“ is created in the same step.
What a download requires
A download of an output is only offered when four things hold:
- The file still exists — not removed by the retention period.
- Rendering has finished.
- There is a signing time. An output without a signature is not served at all.
- The marking obligation is satisfied — if it requires a label for this asset and the output carries none, the download is refused.
The fourth point applies to the file only, not to the manifest. Even for a blocked output the manifest download stays open.
What is recorded and what is not
Every file download served leaves a row in the Content Credentials record — for the original as well as for an output.
The row records different things:
- For the original: that it was the original and went out unsigned, plus the marking policy in force at that moment.
- For an output: certificate number, label state, policy scope, and the burnt-in label variant — the last because it outlives the deletion of the output.
The manifest download and the preview of an output are not recorded.
In the audit trail a download is called „Ausgeliefert“ (served) — the same word in the table and in the dialog on the output.
The manifest comes out of the file
The manifest is read out of the file itself. If none is found, there is no
download. The downloaded file is named after the file, with the extension
.c2pa-manifest.json.
Two details that surprise people
A download link is valid only briefly. If you do not start the download right away, you have to request it again.
The filename does not tell you what you have. The original comes back under the name it was uploaded with — umlauts, capitalisation, spaces and non-Latin script are preserved. And the default for export names is the same stem. Original and signed output are therefore named identically by default.
Differences between the rows
On an output row the action menu appears only once rendering has finished. Before that there is a button to start or retry.
The original row lacks two menu entries an output has: the preview and the Content Credentials audit.
„Content-Credentials-Audit anzeigen“ is visible to owners and admins only.
In a batch
The ZIP export checks the same four points per cell as a single download and writes the same record row per cell. A batch's manifest export is not recorded.
An archive never quietly shrinks. Whatever was refused is listed by name with
its reason in a HINWEIS.txt inside the archive — worded identically to the
single-download refusal.
Special cases
A format verstag can verify but not edit — TIFF or HEIC, say — has no downloads drawer but a single button „Original herunterladen“ (download original).
Where the original was removed by the retention period, the interface says so with a sentence of its own rather than a general error.