Generated with the help of an LLM.

One test went red on CI with no change to the module (pipelines 1037849 and 1037850, the 1.0.0-alpha5 release commit): IngredientOriginTest::testAc7RealFilesThroughTheRoute with the verifier. Its fixture c2patool027-rogue.png carried a rogue CA and signer valid for 30 days, until 9 November 2026 06:38 UTC. Since then the file reads as untrusted as a whole (signingCredential.expired, no time-stamp) instead of as a trusted file whose ingredient is not trusted. Neither reading makes a suggestion, so sites are not affected.

The fix rebuilds the fixture the same way with a rogue certificate valid for ten years. Test only; the assertions are unchanged. The outer signature has no time-stamp, so the file now expires with the C2PA test signer in August 2030.

Comments

maurice1969 created an issue. See original summary.

  • maurice1969 committed 044dd0d6 on 1.0.x 
    Issue #3636349 by maurice1969: SPEC 019 — rebuild the rogue fixture, its...

  • maurice1969 committed 044dd0d6 on main 
    Issue #3636349 by maurice1969: SPEC 019 — rebuild the rogue fixture, its...
maurice1969’s picture

maurice1969 commented
Status: Active » Fixed

Generated with the help of an LLM.

Fixed in 044dd0d on 1.0.x: the fixture is rebuilt with a rogue certificate valid until 2036; the assertions are unchanged. CI 9/9 on pipelines 1037871 (1.0.x) and 1037872 (main). Released in 1.0.0-alpha5.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.