All pull requests

Pull requests

• fix(sdk): Enforce certificate key usage rules (backport #2972)

  #2973·caiopensrc opened Oct 31, 2026Collaborator·

  ·

• fix: only require an absolute claim signature URI from Spec 2.3

  #2971·andyparsons opened Oct 30, 2026Collaborator·

  ·
  1

  2

• fix: support legacy MOV files without ftyp boxes (backport #2967)

  upstream-first-verified
  #2969·caiopensrc opened Oct 30, 2026Collaborator·

  ·
  1

• fix: Preserve numeric arrays after CBOR decoding

  #2968·scouten-adobe opened Oct 29, 2026Collaborator·3 tasks done·

  ·
  1

  8

• feat(ci): alert Slack when main CI starts failing

  #2966·ale-adobe opened Oct 29, 2026Contributor·3 tasks done·

  ·
  2

• fix: require an absolute claim signature URI for v2 claims (backport #2890)

  #2965·caiopensrc opened Oct 29, 2026Collaborator·

  ·
  1

• feat(experimental): add WARC asset handler (C2PA 2.5)

  #2964·mrappard opened Oct 29, 2026Contributor·3 tasks done·

  ·

• feat(experimental): add TTML asset handler (C2PA 2.5)

  #2963·mrappard opened Oct 29, 2026Contributor·3 tasks done·

  ·

• fix: Insert the C2PA APP11 segment after a leading Exif APP1

  #2962·mrappard opened Oct 29, 2026Contributor·3 tasks done·

  ·

• fix: Keep content intact before an end-of-file structured-text block

  #2961·mrappard opened Oct 29, 2026Contributor·3 tasks done·

  ·

• fix: Make the PDF embedded C2PA manifest well-formed (Subtype, Filespec, Params)

  #2960·mrappard opened Oct 29, 2026Contributor·3 tasks done·

  ·

• fix: Restore built-in EKUs in default trust settings

  #2959·scouten-adobe opened Oct 29, 2026Collaborator·3 tasks done·

  ·
  9

• fix: Harden against BMFF Merkle validation bypass from HashMap-ordered mdat pairing (backport #2946)

  #2958·caiopensrc opened Oct 29, 2026Collaborator·

  ·
  1

• fix: Reject duplicate C2PA GEOB frames that share a description

  #2950·mrappard opened Oct 28, 2026Contributor·3 tasks done·

  ·

• fix: Reject box-hash assets with data after the last box

  #2949·ssanthosh opened Oct 28, 2026Contributor·3 tasks·

  ·
  7

  

• feat: configure additional exclusions for SDK-generated BMFF hashes

  #2944·mstattma opened Oct 28, 2026·3 tasks done·

  ·
  1

• feat: Zero-copy bindings

  #2938·mpgopala opened Oct 27, 2026Contributor·2 of 3 tasks·

  ·
  3

• fix: Add deprecation warning log for v1 claim signing

  #2937·ssanthosh opened Oct 27, 2026Contributor·3 tasks·

  ·
  4

  

• chore: release v0.91.8

  release
  #2935·caiopensrc opened Oct 27, 2026Collaborator·

  ·
  1

• feat(identity): validate CAWG verifiable credential bindings (experimental)

  #2927·mrappard opened Oct 26, 2026Contributor·3 tasks done·

  ·

• feat: Retry time-stamp requests on transient failures and bound each attempt

  #2925·christopher5106 opened Oct 26, 2026·3 tasks done·

  ·
  1

  2

• fix: decode compressed PDF manifest streams safely

  #2923·scouten-adobe opened Oct 26, 2026Collaborator·3 tasks done·

  ·
  8

• fix: Report incomplete C2PA APP11 manifests

  backport-stable
  #2922·scouten-adobe opened Oct 26, 2026Collaborator·3 tasks done·

  ·
  3

• fix: reject stale OCSP responses without a trusted timestamp (CAI-13263)

  backport-stable
  #2921·mpgopala opened Oct 26, 2026Contributor·

  ·
  5

• fix: Reject non-hashed icon references during validation (CAI-13410)

  backport-stable
  #2919·mpgopala opened Oct 26, 2026Contributor·

  ·
  6