From 881992c9605500f252cf0137126352185b2ac622 Mon Sep 17 00:00:00 2001 From: CAI Open Source Builds Date: Tue, 22 Sep 2026 13:11:22 -0700 Subject: [PATCH 1/2] chore: release v0.27.21 --- CHANGELOG.md | 17 +++++++++++++++++ Cargo.lock | 14 +++++++------- Cargo.toml | 2 +- 3 files changed, 25 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 84708563..ce40282e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.27.21](https://github.com/contentauth/c2patool/compare/v0.27.20...v0.27.21) +_22 September 2026_ + +### Added + +* Backport remaining release infrastructure to stable ([#344](https://github.com/contentauth/c2patool/pull/344)) + +### Fixed + +* Don't fail promote.yml when the RC version was never bumped ([#347](https://github.com/contentauth/c2patool/pull/347)) +* Update release workflow for the standalone repo's bare v* tag scheme + +### Other + +* Add promote.yml workflow for release-candidate promotion ([#338](https://github.com/contentauth/c2patool/pull/338)) ([#346](https://github.com/contentauth/c2patool/pull/346)) +* Backport stable CI parity updates ([#342](https://github.com/contentauth/c2patool/pull/342)) + ## [0.27.20](https://github.com/contentauth/c2pa-rs/compare/c2patool-v0.27.19...c2patool-v0.27.20) _04 September 2026_ diff --git a/Cargo.lock b/Cargo.lock index 6e2fca1c..6b605632 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -594,7 +594,7 @@ dependencies = [ [[package]] name = "c2patool" -version = "0.27.20" +version = "0.27.21" dependencies = [ "anyhow", "assert_cmd", @@ -1279,7 +1279,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] @@ -1941,9 +1941,9 @@ dependencies = [ [[package]] name = "id3" -version = "1.17.1" +version = "1.17.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24993fcabcbc07c8ac076a8e62db8593d1a5c4dbe81d57e531d2b7cb7f737380" +checksum = "ef8be496a46468ba3d43690775aa3a79102ce4daf7d99e8072589aae1a3cd955" dependencies = [ "bitflags 2.13.2", "byteorder", @@ -2943,7 +2943,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] @@ -3366,7 +3366,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] @@ -3960,7 +3960,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.59.0", + "windows-sys 0.61.2", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 395077f0..e01ca4b7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "c2patool" default-run = "c2patool" -version = "0.27.20" +version = "0.27.21" description = "Tool for displaying and creating C2PA manifests." authors = [ "Gavin Peacock ", From f57f81f32bb76766383a6e894ce1b399254e9308 Mon Sep 17 00:00:00 2001 From: Eric Scouten Date: Tue, 22 Sep 2026 13:28:05 -0700 Subject: [PATCH 2/2] chore: update release to v0.28.0 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CHANGELOG.md | 19 ++++++++----------- Cargo.lock | 2 +- Cargo.toml | 2 +- 3 files changed, 10 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ce40282e..6702a9b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,22 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] -## [0.27.21](https://github.com/contentauth/c2patool/compare/v0.27.20...v0.27.21) +## [0.28.0](https://github.com/contentauth/c2patool/compare/v0.27.20...v0.28.0) _22 September 2026_ -### Added - -* Backport remaining release infrastructure to stable ([#344](https://github.com/contentauth/c2patool/pull/344)) - -### Fixed +### Changed -* Don't fail promote.yml when the RC version was never bumped ([#347](https://github.com/contentauth/c2patool/pull/347)) -* Update release workflow for the standalone repo's bare v* tag scheme +* Update the c2pa-rs dependency to 0.91.0. -### Other +### Breaking changes -* Add promote.yml workflow for release-candidate promotion ([#338](https://github.com/contentauth/c2patool/pull/338)) ([#346](https://github.com/contentauth/c2patool/pull/346)) -* Backport stable CI parity updates ([#342](https://github.com/contentauth/c2patool/pull/342)) +* Signing now verifies the generated manifest by default; set `verify.verify_after_sign = false` in the settings file to retain the previous behavior. +* Trust configuration now supports multiple named trust lists under `trust.anchors`; migrate configurations using the legacy `cawg_trust` or `trust.trust_anchors`, `trust.trust_config`, `trust.user_anchors`, and `trust.allowed_list` fields. +* Remote manifest, OCSP, timestamp, and `did:web` fetches reject redirects to non-public hosts by default. +* Validation follows the C2PA 2.4 rules, and the SVG handler no longer accepts generic XML documents. ## [0.27.20](https://github.com/contentauth/c2pa-rs/compare/c2patool-v0.27.19...c2patool-v0.27.20) _04 September 2026_ diff --git a/Cargo.lock b/Cargo.lock index 6b605632..f1406d36 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -594,7 +594,7 @@ dependencies = [ [[package]] name = "c2patool" -version = "0.27.21" +version = "0.28.0" dependencies = [ "anyhow", "assert_cmd", diff --git a/Cargo.toml b/Cargo.toml index e01ca4b7..9e1bde30 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,7 +1,7 @@ [package] name = "c2patool" default-run = "c2patool" -version = "0.27.21" +version = "0.28.0" description = "Tool for displaying and creating C2PA manifests." authors = [ "Gavin Peacock ",