C2PA Verifier

This is the other half of the C2PA story. Where the C2PA Image Signer stamps a signature into your images, this node reads it back out: it tells you whether a file carries a C2PA manifest, whether the signature still validates, who issued it, and what assertions are baked in. If you're signing your ComfyUI output, you'll want this to check your own work and to audit images other people hand you.

One thing to internalize before you wire anything up: this node verifies files on disk, not pixels. C2PA signatures live in the image file's metadata, and ComfyUI passes tensors around - raw pixel arrays with no metadata attached. That single fact explains every confusing error you're about to hit.

How it works

Same engine as the signer, reversed. The node runs c2patool <path-to-file> and parses the JSON it prints. From that it builds a human-readable summary: whether a manifest was found, the signature's validation state, the issuer, the signing algorithm, and the list of assertion labels (things like stds.schema-org.CreativeWork or a workflow claim). The full manifest comes back as JSON if you want to dig into the details.

The inputs and outputs that matter

• image - technically required, but it's mostly there for workflow compatibility and passes straight through. The node does not use it for verification.
• file_path - this is the field that matters. Paste the full path to a signed file on disk: C:/ComfyUI/output/C2PA_signed_20261006_094628.png. Forward slashes, not backslashes.

Three outputs:

• manifest_json - the complete manifest as a string. Technical, but it's the ground truth.
• summary - the readable verdict ("✅ C2PA Manifest Found / 🔒 Signature: Valid / 👤 Issuer: ..."). This is what you wire into a Show Text or Preview Any node.
• image - passthrough of your input tensor, so you can keep a workflow chain alive.

The trap, and the fix

Feed it a Load Image tensor with no file_path and you'll get a polite "❌ No C2PA manifest found - this is expected!" That's not a bug. Tensors can't carry the signature. The workflow is: sign an image, note the file the signer saved to output/, paste that path into file_path, run, and read the summary. If you ever see "No manifest found" on a real file, the signature was stripped somewhere along the line - re-encoding, screenshots, some image hosts do it automatically.

Installing it

You don't install this separately - it ships in the same pack as the signer. ComfyUI Manager (search "C2PA Image Signer") or git clone https://github.com/mikecaronna/comfyui_c2pa_signer into custom_nodes/, then make sure the c2patool binary is on your PATH (it's the shared engine for both nodes). No pip dependencies to worry about; the node just needs ComfyUI's own PIL/numpy/torch.

Common issues

• "c2patool not found" - binary missing from PATH, or ComfyUI was started before you fixed PATH. Restart it.
• "File not found" - path typo, or backslashes where forward slashes are needed.
• Signature shows up but says invalid - the file was modified after signing, or a test cert is involved. That's C2PA working exactly as designed.

Real talk: C2PA is transparency, not enforcement. Anyone can strip a signature or sign with the shared public test certs. Treat this node as a way to claim and check authorship - not as a guarantee no one will ever lift your work.