[mpgopala]

Summary

Add zero-copy byte-buffer consumption and in-place signing callbacks, alongside the compatibility changes required for the current Rust C API.

Existing vector-returning methods retain their names and signatures. Deprecated API removals and the opaque-stream migration are documented breaking changes.

Changes

Native byte buffers without a C++ copy

• Add move-only ByteBuffer with read-only access, iterators, byte views, and explicit to_vector() conversion.
• Add sign_to_buffer siblings for all five signing overloads.
• Add placeholder_to_buffer and sign_embeddable_to_buffer.
• Preserve the native allocation’s address through handoff and moves.
• Release owned bytes exactly once through c2pa_free.
• Implement existing vector-returning methods through the owning buffer, preserving behavior and ensuring cleanup if vector construction throws.

Capturing, in-place signing callbacks

• Add SignerIntoFunc, receiving borrowed input and mutable signature-buffer views.
• Forward native pointers and lengths directly without intermediate callback vectors.
• Reject oversized results and convert callback exceptions into explicit errors.
• Store capturing callables in stable heap storage across Signer moves and Context ownership transfers.
• Carry callback ownership through ContextBuilder moves, Context creation, and raw release().
• Extend ReleasedBuilder with signer_callback_owner; custom providers must retain it until all native objects using the signer are freed.

The existing vector-based SignerFunc constructor remains available.

Rust C API compatibility

Remove the following deprecated APIs whose underlying C functions were removed:

• Builder::data_hashed_placeholder
• Builder::sign_data_hashed_embeddable
• Builder::format_embeddable
• c2pa::load_settings

Migrate callers and tests to context-scoped settings/signers and the modern placeholder, hashing, signing, and composition APIs.

Preserve default Builder and Reader constructor signatures by initializing through default Contexts. Adapt stream wrappers to hold opaque C2paStream handles rather than inheriting from the C struct.

Ownership documentation and regression coverage

• Document buffer ownership, callback borrows, Context lifetime, and custom-provider handoff requirements.
• Document direct stream-buffer forwarding and deferred native release of HTTP response bodies.
• Add allocation-identity, move, cleanup, callback-error, stream-pointer, and signing round-trip tests.

Compatibility and migration

• Non-deprecated method names and signatures are unchanged.
• C++ consumers must rebuild against the updated headers.
• Use the existing c_stream member when passing stream wrappers to C APIs.
• Attach the signer to the Context before using modern embeddable signing APIs.
• Replace global settings with explicit Context configuration.
• Custom providers adopting ContextBuilder::release() must preserve both callback owners.

Dependency and release status

Validation uses local c2pa-rs and cimpl source checkouts containing the allocation-handoff changes.

C2PA_VERSION remains 0.91.6. The default prebuilt configuration is not the validated integration target for this branch. Before release integration:

1. Publish the cimpl allocation handoff.
2. Integrate the released dependency and publish matching Rust/C FFI prebuilts.
3. Update C2PA_VERSION and run the hosted build/sanitizer matrix.

No publication or hosted CI dispatch is included.

Validation

Configured a local Debug source build with ASan and UBSan:

cmake -S . -B build/zero-copy -DCMAKE_BUILD_TYPE=Debug -DC2PA_BUILD_FROM_SOURCE=ON -DC2PA_RS_PATH=/Users/gsharma/source/c2pa/c2pa-rs -DENABLE_SANITIZERS=ON

• Configuration — passed.
• cmake --build build/zero-copy --target c2pa_c_tests ctest -j 4 — passed.
• build/zero-copy/tests/c2pa_c_tests --gtest_filter='ByteBuffer.*:ZeroCopyBuilder.*:SignerInto.*:ZeroCopyStreams.*' — passed, all 13 new regression tests.
• build/zero-copy/tests/c2pa_c_tests — passed, all 383 tests.
• build/zero-copy/tests/ctest — passed, all 17 C smoke checks.
• git diff --check — passed.

Both C and C++ tests compile with -Wall -Wextra -Werror. No ASan/UBSan errors were reported. LeakSanitizer is unavailable on this macOS configuration.

The local Apple linker rejected the stripped Rust dylib with a LINKEDIT alignment error. Validation used the same Rust sources rebuilt with CARGO_PROFILE_RELEASE_STRIP=none; no repository linker or release-profile changes were made.

Independent signing calls generate fresh labels and salts. Tests verify exact allocation identity and byte conversion at the shared adapter, compare decoded assertions across independent signing calls, and validate signed assets through Reader as Valid or Trusted.