From 9f77193ddc5eda478c96e2752eb06f874930cb03 Mon Sep 17 00:00:00 2001 From: Eric Scouten Date: Mon, 26 Oct 2026 16:09:36 -0700 Subject: [PATCH 1/3] fix: use c2pa-rs 0.91.7 and patched Python TLS roots Select the patched native SDK for release builds and require certifi 2026.10.19 for both runtime tooling and artifact downloads. Document independent trust stores and keep contributor setup on the selected release. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- README.md | 18 ++++++++++++++++++ c2pa-native-version.txt | 2 +- docs/project-contributions.md | 7 +++++-- pyproject.toml | 1 + requirements-dev.txt | 1 + 5 files changed, 26 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 52c01bf9..efa50897 100644 --- a/README.md +++ b/README.md @@ -46,6 +46,24 @@ To use the module in Python code, import the module like this: import c2pa ``` +### TLS trust stores + +Release builds select c2pa-rs `c2pa-v0.91.7` through +`c2pa-native-version.txt`. Rebuild or upgrade installed wheels to update the +bundled native library; updating Python dependencies alone does not update it. +Local source builds and externally supplied libraries must also use patched +c2pa-rs dependencies. + +Python artifact downloads use Requests and require `certifi>=2026.10.19`, whose +CA bundle removes the affected emSign ECC Root CA - G3. This is separate from +the native SDK's TLS verification. Custom bundles (including `REQUESTS_CA_BUNDLE` +or `CURL_CA_BUNDLE` overrides), Python/OpenSSL default stores used by +`urllib.request` in `examples/read.py`, and installer/build tools need their own +updates. Keep the operating system, Python runtime, and packaging tools current, +and verify custom stores against the +[eMudhra incident's affected chains](https://emudhra.we-have-a-problem.com/); +updating certifi does not patch these other stores. + ## Building from local c2pa-rs sources ### Using a virtual environment with local builds diff --git a/c2pa-native-version.txt b/c2pa-native-version.txt index 9afb3915..65a1dfc3 100644 --- a/c2pa-native-version.txt +++ b/c2pa-native-version.txt @@ -1 +1 @@ -c2pa-v0.91.6 +c2pa-v0.91.7 diff --git a/docs/project-contributions.md b/docs/project-contributions.md index adc522c9..48820ba9 100644 --- a/docs/project-contributions.md +++ b/docs/project-contributions.md @@ -28,12 +28,15 @@ pip install -r requirements.txt pip install -r requirements-dev.txt ``` -Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the current version you want (for example, as shown below for v0.91.3): +Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the release selected in `c2pa-native-version.txt`: ```bash -python scripts/download_artifacts.py c2pa-v0.91.3 +make download-native-artifacts ``` +Without `make`, pass the tag from `c2pa-native-version.txt` directly to +`python scripts/download_artifacts.py` (currently `c2pa-v0.91.7`). + Install the package in development mode: ```bash diff --git a/pyproject.toml b/pyproject.toml index 7c3cd5dd..15e5e5ca 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -24,6 +24,7 @@ urls = {homepage = "https://contentauthenticity.org", repository = "https://gith dependencies = [ "toml>=0.10.2", "cryptography>=41.0.0", + "certifi>=2026.10.19", "requests>=2.0.0" ] diff --git a/requirements-dev.txt b/requirements-dev.txt index 083439e7..45a2351d 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -9,6 +9,7 @@ pytest>=8.1.0 # for downloading the library artifacts requests>=2.0.0 +certifi>=2026.10.19 # Code formatting autopep8>=2.3.0 From 06b10d433e573dd66e7c0c45870fc4352373bb8d Mon Sep 17 00:00:00 2001 From: Eric Scouten Date: Mon, 26 Oct 2026 16:12:38 -0700 Subject: [PATCH 2/3] chore: consolidate 0.38.3 package bump from #352 Include the package-version bump alongside the native SDK and TLS trust-store updates in #353. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 15e5e5ca..3178d33c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "c2pa-python" -version = "0.38.2" +version = "0.38.3" requires-python = ">=3.10" description = "Python bindings for the C2PA Content Authenticity Initiative (CAI) library" readme = { file = "README.md", content-type = "text/markdown" } From 989a03d9999971170f0e8d07d77cbe8aa49cbc6d Mon Sep 17 00:00:00 2001 From: Austin Le Date: Tue, 27 Oct 2026 11:30:28 -0700 Subject: [PATCH 3/3] docs: move TLS update rationale to release notes Address review feedback on #353 by keeping the 0.38.3 TLS trust-store guidance in the release notes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- README.md | 18 ------------------ docs/release-notes.md | 20 ++++++++++++++++++++ 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/README.md b/README.md index efa50897..52c01bf9 100644 --- a/README.md +++ b/README.md @@ -46,24 +46,6 @@ To use the module in Python code, import the module like this: import c2pa ``` -### TLS trust stores - -Release builds select c2pa-rs `c2pa-v0.91.7` through -`c2pa-native-version.txt`. Rebuild or upgrade installed wheels to update the -bundled native library; updating Python dependencies alone does not update it. -Local source builds and externally supplied libraries must also use patched -c2pa-rs dependencies. - -Python artifact downloads use Requests and require `certifi>=2026.10.19`, whose -CA bundle removes the affected emSign ECC Root CA - G3. This is separate from -the native SDK's TLS verification. Custom bundles (including `REQUESTS_CA_BUNDLE` -or `CURL_CA_BUNDLE` overrides), Python/OpenSSL default stores used by -`urllib.request` in `examples/read.py`, and installer/build tools need their own -updates. Keep the operating system, Python runtime, and packaging tools current, -and verify custom stores against the -[eMudhra incident's affected chains](https://emudhra.we-have-a-problem.com/); -updating certifi does not patch these other stores. - ## Building from local c2pa-rs sources ### Using a virtual environment with local builds diff --git a/docs/release-notes.md b/docs/release-notes.md index f8f09717..1382f915 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -1,5 +1,25 @@ # Release notes +## Version 0.38.3 + +### TLS trust stores + +Release builds select c2pa-rs `c2pa-v0.91.7` through +`c2pa-native-version.txt`. Rebuild or upgrade installed wheels to update the +bundled native library; updating Python dependencies alone does not update it. +Local source builds and externally supplied libraries must also use patched +c2pa-rs dependencies. + +Python artifact downloads use Requests and require `certifi>=2026.10.19`, whose +CA bundle removes the affected emSign ECC Root CA - G3. This is separate from +the native SDK's TLS verification. Custom bundles (including `REQUESTS_CA_BUNDLE` +or `CURL_CA_BUNDLE` overrides), Python/OpenSSL default stores used by +`urllib.request` in `examples/read.py`, and installer/build tools need their own +updates. Keep the operating system, Python runtime, and packaging tools current, +and verify custom stores against the +[eMudhra incident's affected chains](https://emudhra.we-have-a-problem.com/); +updating certifi does not patch these other stores. + ## Version 0.33.0 ### Breaking changes