Problem/Motivation

The module asks for provemark/content-credentials: ^0.19.3. Library 0.19.5 (released 2026-10-25) refuses verifier versions below 0.8.2 through its conflict. Older library versions do not, so a site can still end up with an older verifier.

Verifier 0.8.0 had two ways to a wrong "Trusted" verdict (fixed in 0.8.1, see #3632826). Verifier 0.8.1 accepts two kinds of signature that c2patool rejects (fixed in 0.8.2, see #3633006).

A normal composer update installs library 0.19.5 and verifier 0.8.2, so most sites are fine. But a site that pins the verifier to an older version falls back to an older library. Dry run with only the library and the verifier, no Drupal site yet:

  • library ^0.19.3, verifier pinned to 0.8.1: Composer picks library 0.19.4 and verifier 0.8.1
  • library ^0.19.5, verifier pinned to 0.8.1: refused, "provemark/content-credentials v0.19.5 conflicts with provemark/c2pa-verifier <0.8.2 || >=0.9"

Proposed resolution

Raise the requirement to ^0.19.5 in composer.json, with amendments to SPEC-013, SPEC-016 and SPEC-019. Repeat the dry run on Drupal 11.3 and 11.4 with the verifier pinned to 0.8.1, and run the full test suite on both.

This goes into the next alpha. No separate release, since a normal update already gets the fixed versions.

Remaining tasks

  • composer.json: ^0.19.5
  • Spec amendments
  • Dry run and full suite on 11.3 and 11.4
  • CHANGELOG entry under Unreleased

Comments

maurice1969 created an issue. See original summary.

  • maurice1969 committed 4b41735f on 1.0.x 
    Issue #3633035 by maurice1969: Require provemark/content-credentials ^0....

  • maurice1969 committed 4b41735f on main 
    Issue #3633035 by maurice1969: Require provemark/content-credentials ^0....
maurice1969’s picture

maurice1969 commented
Status: Active » Fixed

Committed to 1.0.x and main as 4b41735: composer.json now requires provemark/content-credentials: ^0.19.5, plus a CHANGELOG entry under Unreleased. It ships with the next alpha.

Checked on fresh 11.3.20 and 11.4.11 sites, with the module from a path repository:

  • verifier pinned to 0.8.1: refused on both, because library 0.19.5 conflicts with provemark/c2pa-verifier &lt;0.8.2 || &gt;=0.9
  • verifier ^0.8: library 0.19.5 and verifier 0.8.2 on both
  • full test suite with those versions: 400 tests, exit 0 on both

Pipelines for 1.0.x and main are green.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.