[scouten-adobe]

Summary

• Update the authoritative C2PA_VERSION selector from 0.91.6 to the published c2pa-v0.91.7 release, which includes upstream eMudhra TLS distrust updates. CMake platform downloads and CI inherit this selector; the Emscripten download also derives its version from it.
• Version the Emscripten prebuilt cache directory so an existing older library cannot bypass the new release download.
• Document separately managed build-tool/resolver TLS stores and local-source/native-library overrides.
• Incorporate chore: Bump project version to 0.26.17 #279's C++ project version bump from 0.26.16 to 0.26.17 by merging its original commit c99d87734e5bfe33e9a6aa90dd1e6be136bda81e, preserving tmathern's authorship and commit history. The native SDK selector remains 0.91.7.

#279 is now incorporated into this PR. Its complete diff contains only the project version bump in CMakeLists.txt; it contains no release-notes file changes. The nightly preflight #270 remains untouched. No repository PR template is present.

Additional TLS / certificate dependencies

• Default native integration links the Rust C ABI library (src/CMakeLists.txt:120-129,299-315); no separate C++ libcurl/OpenSSL TLS client or bundled public CA store was found in the tracked wrapper sources. On the tested macOS ARM64 release, otool -L shows no dynamic libcurl/OpenSSL dependency in either shipped library. This does not prove trust behavior on every platform or inspect statically linked internals.
• Custom resolver callbacks delegate HTTP outside the native client's trust policy (include/c2pa.hpp:400-409, src/c2pa_context.cpp:193-208). The Emscripten example uses emscripten_fetch (examples/emscripten_example.cpp:86-114): update the browser/JavaScript host's TLS trust independently; no host CA dependency is pinned here.
• Build-only downloads use CMake FetchContent (src/CMakeLists.txt:12,120-129, tests/CMakeLists.txt:4-9) and command-line curl (Makefile:150-163), independently of the SDK roots. This host's CMake links system libcurl; curl reports SecureTransport/LibreSSL. Build hosts need their vendor's incident remediation, including cross-signed certificate paths, not only an SDK update.
• Dockerfile.test:2-13 uses Alpine 3.19 and unversioned ca-certificates for build tooling. A patched CA package is not guaranteed by this file; incident guidance lists Alpine 20261020-r0. The old distro/tooling remains an externally managed build/test gap; no speculative distro migration was included.
• C2PA_RS_PATH and C2PA_C_LIB_OVERRIDE are intentional consumer-controlled escape hatches (src/CMakeLists.txt:81-87,299-306), not automatically upgraded by the release selector. README now explicitly requires updating them.

Incident reference: https://emudhra.we-have-a-problem.com/ (includes affected roots, intermediates, cross-signs and patched stores). No blanket claim that all C++ hosts are remediated.

Validation

• cmake -S . -B build/debug -G Ninja -DCMAKE_BUILD_TYPE=Debug and cmake --build build/debug --parallel 4: passed on macOS ARM64; C/C++ SDK, C and C++ tests, and examples compiled. Repeated successfully after merging chore: Bump project version to 0.26.17 #279.
• ctest --test-dir build/debug --output-on-failure: 2/2 CTest targets passed (C++ suite and C suite), including after merging chore: Bump project version to 0.26.17 #279.
• git merge-base --is-ancestor c99d87734e5bfe33e9a6aa90dd1e6be136bda81e HEAD: passed, confirming the original colleague-authored commit is preserved.
• Called the downloaded library's c2pa_version(): exactly c2pa-c-ffi/0.91.7 c2pa-rs/0.91.7.
• Independently downloaded release archives and matched SHA-256 against GitHub release asset digests:
  • ARM64 macOS: 8a0c828e41a5c8a81d83426085b4e4dfca66a7e7b3d8fee3f31089812e63b5fd.
  • Emscripten: 6b7d8a183cf74c718e58dea8994572f4d415c2faa9fc2d62f161f0589069a30d; archive contains include/c2pa.h and lib/libc2pa_c.a.
• make -n emscripten-example: confirmed 0.91.7 URL and versioned cache. Full Emscripten build not run: emcc is unavailable.
• git diff --check: passed. Existing download declarations have no pinned checksums to update; no new checksum mechanism was introduced.
• Windows/Linux, sanitizers, local Rust source builds and compromised-chain rejection were not exercised locally; CI retains its existing platform matrix.