fix: use c2pa-rs 0.91.7 and patched Python TLS roots

c2pa-native-version.txt

@@ -1 +1 @@
-c2pa-v0.91.6
+c2pa-v0.91.7

docs/project-contributions.md

@@ -28,12 +28,15 @@ pip install -r requirements.txt
 pip install -r requirements-dev.txt
 ```
 
-Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the current version you want (for example, as shown below for v0.91.3):
+Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the release selected in `c2pa-native-version.txt`:
 
 ```bash
-python scripts/download_artifacts.py c2pa-v0.91.3
+make download-native-artifacts
 ```
 
+Without `make`, pass the tag from `c2pa-native-version.txt` directly to
+`python scripts/download_artifacts.py` (currently `c2pa-v0.91.7`).
+
 Install the package in development mode:
 
 ```bash

docs/release-notes.md

@@ -1,5 +1,25 @@
 # Release notes
 
+## Version 0.38.3
+
+### TLS trust stores
+
+Release builds select c2pa-rs `c2pa-v0.91.7` through
+`c2pa-native-version.txt`. Rebuild or upgrade installed wheels to update the
+bundled native library; updating Python dependencies alone does not update it.
+Local source builds and externally supplied libraries must also use patched
+c2pa-rs dependencies.
+
+Python artifact downloads use Requests and require `certifi>=2026.10.19`, whose
+CA bundle removes the affected emSign ECC Root CA - G3. This is separate from
+the native SDK's TLS verification. Custom bundles (including `REQUESTS_CA_BUNDLE`
+or `CURL_CA_BUNDLE` overrides), Python/OpenSSL default stores used by
+`urllib.request` in `examples/read.py`, and installer/build tools need their own
+updates. Keep the operating system, Python runtime, and packaging tools current,
+and verify custom stores against the
+[eMudhra incident's affected chains](https://emudhra.we-have-a-problem.com/);
+updating certifi does not patch these other stores.
+
 ## Version 0.33.0
 
 ### Breaking changes

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "c2pa-python"
-version = "0.38.2"
+version = "0.38.3"
 requires-python = ">=3.10"
 description = "Python bindings for the C2PA Content Authenticity Initiative (CAI) library"
 readme = { file = "README.md", content-type = "text/markdown" }
@@ -24,6 +24,7 @@ urls = {homepage = "https://contentauthenticity.org", repository = "https://gith
 dependencies = [
     "toml>=0.10.2",
     "cryptography>=41.0.0",
+    "certifi>=2026.10.19",
     "requests>=2.0.0"
 ]
 

requirements-dev.txt

@@ -9,6 +9,7 @@ pytest>=8.1.0
 
 # for downloading the library artifacts
 requests>=2.0.0
+certifi>=2026.10.19
 
 # Code formatting
 autopep8>=2.3.0