Setting claim_generator_info.specVersion makes the signed claim unreadable (fixed in c2pa-rs 0.91.2) #342

Describe the bug

c2pa-python 0.38.0 bundles c2pa-rs 0.91.0 (c2pa-native-version.txt on main is still c2pa-v0.91.0). Including specVersion in claim_generator_info makes every signed asset fail to read.

The field is stored correctly inside claim_generator_info, and a second specVersion pair is appended after the claim CBOR. That pair is not counted in the claim map, so a reader stops where the header says the claim ends and then hits 18 leftover bytes:

Decoding: claim could not be converted from CBOR: claim_cbor: Syntax error: unexpected trailing data: 18 bytes remaining

The 18 bytes are the key specVersion and the value 2.4.0. Omitting specVersion produces a claim that reads back, but the published manifest then has no specVersion, which fails the C2PA conformance check that requires it.

c2pa-rs 0.91.2 already fixes this: only encode claim CBOR with specVersion if it's present, released on 2026-10-06. No published c2pa-python wraps that release.

To Reproduce

With c2pa-python 0.38.0, sign a PNG whose manifest includes:

"claim_generator_info": [
  {"name": "Example", "version": "1.0.0", "specVersion": "2.4.0"}
]

Then open the signed bytes with Reader. Signing with the same manifest and no specVersion reads back successfully.

Decoding the claim box directly: 468 bytes with specVersion (18 trailing) versus 432 bytes without it (0 trailing).

Expected behavior

Setting specVersion should produce a claim that readers can open, with specVersion inside claim_generator_info. Bumping c2pa-native-version.txt to c2pa-v0.91.2 and cutting a release would do that.

Desktop

• OS: macOS
• SDK version: c2pa-python 0.38.0 (c2pa-rs 0.91.0)

Additional context

Leaving specVersion out is the only way to get a readable asset on 0.38.0, so every asset signed that way fails the conformance check for the missing field. Putting the field back fails conformance harder, because the file no longer parses.