content_credentials 1.0.0-alpha6

The sixth alpha of Content Credentials. AI Disclosure 1.0.0-beta1 is now the lowest release it works with, and the status report warns about two settings that let whoever uploads a file decide what reads as trusted. No database updates. It is still an alpha: it has never run in production, and this project is not covered by Drupal's security advisory policy.

What changed since 1.0.0-alpha5

• Two more warnings on the status report (#3636378). C2PA test certificate trusted when the trust anchors hold a certificate issued under the C2PA test root, such as the es256 pair in c2patool's sample folder, whose signing key is public; recognised by signature, not by name. Reading service over plain HTTP when the service route's address is http:// on another host than this one.
• AI Disclosure 1.0.0-beta1 is the floor (#3636373). From beta1 an editor's accepted or dismissed suggestion stays when a later file reads the same.

Install or update

composer require drupal/ai_disclosure:^1.0.0-beta1
composer require drupal/content_credentials:^1.0@alpha

# For the pure-PHP route:
composer require provemark/c2pa-verifier:^0.10

# From an earlier alpha, with AI Disclosure beta1 or later:
composer update drupal/content_credentials
drush updatedb

# From an earlier alpha, still on AI Disclosure 1.0.0-alpha3:
composer update drupal/content_credentials drupal/ai_disclosure
drush updatedb

Composer is required. On a site still on AI Disclosure 1.0.0-alpha3, updating this module alone reports success and changes nothing; update both, then run drush updatedb for AI Disclosure's own updates.

Requirements

• Drupal 11.3 or later; PHP 8.3 or later.
• AI Disclosure 1.0.0-beta1 or later.
• provemark/content-credentials 0.20.
• For the pure-PHP route, provemark/c2pa-verifier 0.10.

Known issues

• drush queue:run content_credentials_read exits with status 1 while the reading service is down, from the second failed read in a row: drush turns the module's request to pause the queue into an error. The queued files are kept; cron is not affected.
• The test-certificate warning recognises certificates signed by the C2PA test root or by c2patool's es256 intermediate. A signer from another sample chain of the same root, pasted without its intermediate, is not recognised.

Unchanged from alpha5: the remaining known issues, from the evidence archive's limits to the routes' differences with c2pa-rs, are listed in the CHANGELOG. Never run in production.