c2patool returns an assertion missing error to stderr

[hackerfactor]

Tested with c2patool 0.25.0. (Probably happens on older versions.) Note: This is not one of my forgeries. This is a seen-in-the-wild hostile image.

Test image:

Result:

[2025-11-05T20:51:08Z ERROR c2pa::status_tracker] Validation error: LogItem {
        kind: Failure,
        label: "self#jumbf=/c2pa/adobe:urn:uuid:a16995ca-7adb-4bb0-9fbf-634d146dec3c/c2pa.databoxes/c2pa.data",
        description: "could not resolve icon address",
        crate_name: "c2pa",
        crate_version: "0.57.0",
        file: "sdk/src/claim.rs",
        function: "verify_icons",
        line: 2576,
        err_val: Some(
            "AssertionMissing { url: \"self#jumbf=/c2pa/adobe:urn:uuid:a16995ca-7adb-4bb0-9fbf-634d146dec3c/c2pa.databoxes/c2pa.data\" }",
        ),
        validation_status: Some(
            "assertion.missing",
        ),
        ingredient_uri: None,
    }

Even though there is an error, it return ($?) a zero "0".

[hackerfactor]

May be due to a bad build. My build process:

rm -f Cargo.lock
git pull
cargo update
cargo build --bin c2patool --target x86_64-unknown-linux-musl --release
# Output:
# ./target/x86_64-unknown-linux-musl/release/c2patool
./target/x86_64-unknown-linux-musl/release/c2patool --version
c2patool 0.25.0

While it says 0.25.0, it acted like 0.23.4. When I did a clean git pull in a different directory, it acted correctly and this error did not appear. However, it still returns a 0, even though there is a mismatch.

[github-jira-sync-bot]

:white_check_mark: Jira issue https://jira.corp.adobe.com/browse/CAI-10445 is successfully created for this GitHub issue.