The selected native SDK release is c2pa-rs 0.91.7, including its eMudhra
TLS distrust updates. CMake downloads and the Emscripten example's curl
download use the build host's TLS implementation and trust store, not the
SDK's roots. Keep those tools and their CA stores updated separately (including
ca-certificates in container builds).
Applications that supply ContextBuilder::with_http_resolver are responsible
for their resolver's TLS verification and trust-store updates. In particular,
the Emscripten example delegates HTTP to emscripten_fetch, so its HTTPS trust
is controlled by the browser or JavaScript host, not the Rust SDK. Updating the
SDK alone does not update those stores. See the
eMudhra incident guidance for affected
certificate chains and patched trust-store versions.
Use the c2pa-v0.91.7 tag for the matching native release. Local-source builds
use the checkout supplied through C2PA_RS_PATH; they do not select or update
that checkout automatically. Likewise, consumers using C2PA_C_LIB_OVERRIDE
must update their replacement native library themselves.
This release includes changes relating to trust validation and handling (made in the Rust library v0.68.0, see also trust lists for more details on trust lists).
Additionally, this release adds support for:
- Configuring the SDK using
ContextandSettings. - Using working stores and archives.
- Using
BuilderandReadertogether to selectively construct a manifest by filtering actions and ingredients.
For answers to frequently asked questions about these features, see the FAQs.