content_credentials 1.0.0-alpha7

The seventh alpha of Content Credentials. Content saved before its type was opted in can now be read, and the module answers the C2PA Conformance Program: a Drush command that reads one file the way the programme's test harness asks, and, on the verifier route, the programme's two trust lists kept current by the site. One database update. It is still an alpha: it has never run in production, and this project is not covered by Drupal's security advisory policy.

What changed since 1.0.0-alpha6

• Read existing content (#3637382). A confirm form, linked from the settings form, queues the files of every existing entity of the types that are read; cron reads them. A suggestion an editor dismissed or accepted keeps its status when its unchanged file is read again.
• A Drush command for the C2PA Conformance Program (#3638150). drush content-credentials:conformance reads one file on the verifier route, through the same path an upload takes, against the trust lists and the validation time it is given, and prints the verifier's crJSON. Exit 0 for Trusted or Valid, 1 for Invalid, 2 when there is no answer. It stores nothing and suggests nothing.
• The programme's trust lists, kept current (#3638154). On the verifier route a site can choose the C2PA Conformance Program's two lists instead of pasted anchors: fetched when the settings are saved and once a day on cron, the last list the verifier accepted kept when a fetch fails, their age on the status report. drush content-credentials:trust-lists fetches them now. Off by default.
• Library 0.22 and verifier 0.11 (#3637949, #3638150). Verifier 0.11 verifies the general box hash in a JPEG, which Microsoft Bing Image Creator writes in every file; up to 0.10 such a file is Invalid on the verifier route.

Install or update

composer require drupal/ai_disclosure:^1.0.0-beta1
composer require drupal/content_credentials:^1.0@alpha

# For the pure-PHP route:
composer require provemark/c2pa-verifier:^0.11

# From an earlier alpha, with the verifier installed:
composer require provemark/c2pa-verifier:^0.11 drupal/content_credentials:^1.0@alpha -W
drush updatedb

# From an earlier alpha, without the verifier:
composer update drupal/content_credentials -W
drush updatedb

Composer is required. Library 0.22 refuses a verifier below 0.11, so composer update drupal/content_credentials without -W, or with the verifier left at ^0.10, reports success and keeps 1.0.0-alpha6. Update 11004 adds the trust-list settings; the anchors you entered stay in use until you choose the official lists.

Requirements

• Drupal 11.3 or later; PHP 8.3 or later.
• AI Disclosure 1.0.0-beta1 or later.
• provemark/content-credentials 0.22.
• For the pure-PHP route, provemark/c2pa-verifier 0.11. For the Drush commands, Drush.

Known issues

• Revocation is not checked on the verifier route: the verifier asks no OCSP responder and no revocation list, so a certificate revoked after signing, in a file that staples no answer, still reads as trusted.

Unchanged from alpha6: the remaining known issues, from the evidence archive's limits to the routes' differences with c2pa-rs, are listed in the CHANGELOG. Never run in production.