Open Source
The published Apache 2.0 repositories and how to build with them.
A verifier you cannot inspect is just another thing you have to trust. The core of Apertrue's verification stack is published under Apache 2.0 so you can read it, rebuild it, and reuse it in your own projects.
The repositories
| Repository | What it is |
|---|---|
| Apertrue/circuits | The Noir circuits behind zk-C2PA verification, including the WebAuthn account contract and the Aztec verifier. |
| Apertrue/c2pa-extractor | TypeScript library that parses C2PA manifests (JUMBF, COSE, X.509) and produces circuit-ready inputs, entirely client-side. |
| Apertrue/noir-web-prover | Browser proving toolkit for Noir and bb.js: worker pools with clean teardown, verification-key caching, and hardware-aware proving strategy. |
| Apertrue/aztec-passkey-wallet | A passkey-controlled Aztec account library. WebAuthn P-256 assertions are verified in-circuit, so biometric approval is enforced per transaction. |
| Apertrue/sensor-circuits | The sensor fingerprint circuit family used by the hardware line of verification. |
Everything lives under the Apertrue organisation on GitHub. Issues and pull requests are welcome.
Where to start
If you want to verify C2PA media in your own app, start with c2pa-extractor for parsing and circuits for the proof system. If you want to prove any Noir circuit in the browser, noir-web-prover packages the worker and caching patterns we run in production. If you are building on Aztec, the passkey wallet is a complete account abstraction you can drop in.
What stays private
The open repositories cover the mechanism: how verification works and how proofs are made. Trust-list curation, oracle operations, and our production infrastructure remain private, because they are operational security surfaces rather than things a verifier needs to inspect.