Problem/Motivation

provemark/c2pa-verifier 0.8.1 called a file Valid, or Trusted under a trusted root, in two cases where c2patool says Invalid: an ECDSA signature made with a key on another curve than its algorithm names (ES256 under a P-384 key and the like), and a signer certificate signed with Ed25519 that carries algorithm parameters. 0.8.2 refuses both. In each case the signature was made with the certificate holder's own key, so the verifier lists this as a change rather than a security fix.

This module asks for the verifier at ^0.8, which already allows 0.8.2, so a new install gets it and the requirement does not need to change. A site that installed the verifier before 25 October 2026 should update it.

Proposed resolution

Run the suite against verifier 0.8.2 and add a Changed entry under Unreleased in the CHANGELOG that tells sites on the verifier route to run composer update provemark/c2pa-verifier. No code or spec changes.

Remaining tasks

  • [x] Suite and CHANGELOG

Comments

maurice1969 created an issue. See original summary.

  • maurice1969 committed e8d59a51 on main 
    Issue #3633006 by maurice1969: CHANGELOG — update provemark/c2pa-...

  • maurice1969 committed e8d59a51 on 1.0.x 
    Issue #3633006 by maurice1969: CHANGELOG — update provemark/c2pa-...
maurice1969’s picture

maurice1969 commented
Issue summary: View changes
Status: Active » Fixed

Done in e8d59a5 on main and 1.0.x: a Changed entry under Unreleased in the CHANGELOG. The unit suite passes against verifier 0.8.2 (232 tests), and pipelines 1015904 and 1015905 are green, every job (9 of 9 each). The library, provemark/content-credentials, released 0.19.5 the same day, which requires verifier 0.8.2 or later in the 0.8 series. Raising this module's library requirement stays for the next alpha.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.