From c99d87734e5bfe33e9a6aa90dd1e6be136bda81e Mon Sep 17 00:00:00 2001 From: tmathern <60901087+tmathern@users.noreply.github.com> Date: Mon, 26 Oct 2026 13:10:30 -0700 Subject: [PATCH 1/3] chore: Bump project version to 0.26.17 --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4dd0ad3..42295c3 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -14,7 +14,7 @@ cmake_minimum_required(VERSION 3.27) # This is the current version of this C++ project -project(c2pa-c VERSION 0.26.16) +project(c2pa-c VERSION 0.26.17) # Set the version of the c2pa_rs library used set(C2PA_VERSION "0.91.6") From 770742cafbf5f1949855798a848fbbff15c7c58d Mon Sep 17 00:00:00 2001 From: Eric Scouten Date: Mon, 26 Oct 2026 15:58:14 -0700 Subject: [PATCH 2/3] chore: update native c2pa SDK to 0.91.7 Version the Emscripten artifact cache to avoid retaining older native libraries. Document separately managed resolver and build-tool TLS stores. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CMakeLists.txt | 2 +- Makefile | 2 +- README.md | 19 +++++++++++++++++++ 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4dd0ad3..41add7c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -17,7 +17,7 @@ cmake_minimum_required(VERSION 3.27) project(c2pa-c VERSION 0.26.16) # Set the version of the c2pa_rs library used -set(C2PA_VERSION "0.91.6") +set(C2PA_VERSION "0.91.7") set(CMAKE_POLICY_DEFAULT_CMP0135 NEW) set(CMAKE_C_STANDARD 17) diff --git a/Makefile b/Makefile index cf1f4fd..3697a4d 100644 --- a/Makefile +++ b/Makefile @@ -149,7 +149,7 @@ training: release # Downloads prebuilt wasm library from c2pa-rs releases. C2PA_VERSION := $(shell grep 'set.C2PA_VERSION' CMakeLists.txt | sed 's/[^"]*"//;s/".*//') EMSCRIPTEN_PREBUILT_URL = https://github.com/contentauth/c2pa-rs/releases/download/c2pa-v$(C2PA_VERSION)/c2pa-v$(C2PA_VERSION)-wasm32-unknown-emscripten.zip -EMSCRIPTEN_PREBUILT_DIR = $(BUILD_DIR)/emscripten-prebuilt +EMSCRIPTEN_PREBUILT_DIR = $(BUILD_DIR)/emscripten-prebuilt/$(C2PA_VERSION) EMSCRIPTEN_OUTPUT_DIR = $(BUILD_DIR)/emscripten-example emscripten-example: diff --git a/README.md b/README.md index cfa1f95..9999b1c 100644 --- a/README.md +++ b/README.md @@ -70,6 +70,20 @@ make release This will download the [prebuilt libraries published with c2pa releases](https://github.com/contentauth/c2pa-rs/releases), build and link the C++ code. +The selected native SDK release is c2pa-rs **0.91.7**, including its eMudhra +TLS distrust updates. CMake downloads and the Emscripten example's `curl` +download use the build host's TLS implementation and trust store, not the +SDK's roots. Keep those tools and their CA stores updated separately (including +`ca-certificates` in container builds). + +Applications that supply `ContextBuilder::with_http_resolver` are responsible +for their resolver's TLS verification and trust-store updates. In particular, +the Emscripten example delegates HTTP to `emscripten_fetch`, so its HTTPS trust +is controlled by the browser or JavaScript host, not the Rust SDK. Updating the +SDK alone does not update those stores. See the +[eMudhra incident guidance](https://emudhra.we-have-a-problem.com/) for affected +certificate chains and patched trust-store versions. + The Makefile has a number of other targets; for example: - `test` to run unit tests - `examples` to build and run the C++ examples. @@ -82,6 +96,11 @@ Results are saved in the `build` directory. This project can also be built entirely from source (without pre-built library download), with the prerequisite that you will also need [c2pa-rs](https://github.com/contentauth/c2pa-rs) on the local machine, as well as the [Rust toolchain](https://rust-lang.org/tools/install/). +Use the `c2pa-v0.91.7` tag for the matching native release. Local-source builds +use the checkout supplied through `C2PA_RS_PATH`; they do not select or update +that checkout automatically. Likewise, consumers using `C2PA_C_LIB_OVERRIDE` +must update their replacement native library themselves. + To build in this case, the build scripts need to be able to locate the `c2pa-rs` sources as well as the library this builds for linking. This is done by setting environment variables in the terminal where the builds will run. ```sh From dbf503dd8541b22aa05618cd4a21fea5e562bb98 Mon Sep 17 00:00:00 2001 From: Austin Le Date: Tue, 27 Oct 2026 11:19:28 -0700 Subject: [PATCH 3/3] docs: move native SDK update guidance to release notes Address PR #280 review feedback by keeping release-specific TLS and native library update guidance out of the README. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- README.md | 19 ------------------- docs/release-notes.md | 21 +++++++++++++++++++++ 2 files changed, 21 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 9999b1c..cfa1f95 100644 --- a/README.md +++ b/README.md @@ -70,20 +70,6 @@ make release This will download the [prebuilt libraries published with c2pa releases](https://github.com/contentauth/c2pa-rs/releases), build and link the C++ code. -The selected native SDK release is c2pa-rs **0.91.7**, including its eMudhra -TLS distrust updates. CMake downloads and the Emscripten example's `curl` -download use the build host's TLS implementation and trust store, not the -SDK's roots. Keep those tools and their CA stores updated separately (including -`ca-certificates` in container builds). - -Applications that supply `ContextBuilder::with_http_resolver` are responsible -for their resolver's TLS verification and trust-store updates. In particular, -the Emscripten example delegates HTTP to `emscripten_fetch`, so its HTTPS trust -is controlled by the browser or JavaScript host, not the Rust SDK. Updating the -SDK alone does not update those stores. See the -[eMudhra incident guidance](https://emudhra.we-have-a-problem.com/) for affected -certificate chains and patched trust-store versions. - The Makefile has a number of other targets; for example: - `test` to run unit tests - `examples` to build and run the C++ examples. @@ -96,11 +82,6 @@ Results are saved in the `build` directory. This project can also be built entirely from source (without pre-built library download), with the prerequisite that you will also need [c2pa-rs](https://github.com/contentauth/c2pa-rs) on the local machine, as well as the [Rust toolchain](https://rust-lang.org/tools/install/). -Use the `c2pa-v0.91.7` tag for the matching native release. Local-source builds -use the checkout supplied through `C2PA_RS_PATH`; they do not select or update -that checkout automatically. Likewise, consumers using `C2PA_C_LIB_OVERRIDE` -must update their replacement native library themselves. - To build in this case, the build scripts need to be able to locate the `c2pa-rs` sources as well as the library this builds for linking. This is done by setting environment variables in the terminal where the builds will run. ```sh diff --git a/docs/release-notes.md b/docs/release-notes.md index fbb7b42..7522f95 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -1,5 +1,26 @@ # Release notes +## 26 Oct 2026 + +The selected native SDK release is c2pa-rs **0.91.7**, including its eMudhra +TLS distrust updates. CMake downloads and the Emscripten example's `curl` +download use the build host's TLS implementation and trust store, not the +SDK's roots. Keep those tools and their CA stores updated separately (including +`ca-certificates` in container builds). + +Applications that supply `ContextBuilder::with_http_resolver` are responsible +for their resolver's TLS verification and trust-store updates. In particular, +the Emscripten example delegates HTTP to `emscripten_fetch`, so its HTTPS trust +is controlled by the browser or JavaScript host, not the Rust SDK. Updating the +SDK alone does not update those stores. See the +[eMudhra incident guidance](https://emudhra.we-have-a-problem.com/) for affected +certificate chains and patched trust-store versions. + +Use the `c2pa-v0.91.7` tag for the matching native release. Local-source builds +use the checkout supplied through `C2PA_RS_PATH`; they do not select or update +that checkout automatically. Likewise, consumers using `C2PA_C_LIB_OVERRIDE` +must update their replacement native library themselves. + ## 3 Mar 2026 This release includes changes relating to trust validation and handling (made in the Rust library [v0.68.0](https://github.com/contentauth/c2pa-rs/releases/tag/c2pa-v0.68.0), see also [trust lists](https://opensource.contentauthenticity.org/docs/conformance/trust-lists) for more details on trust lists).