# Changelog All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). As of December 2025 and until the 1.0.0 version is released, the CAI team will only make minor version changes (incrementing the `x` in `0.x.0`) if breaking changes are made. Features will now result in a patch version change (incrementing the `y` in `0.x.y`). This brings us into closer compliance with typical SemVer practice (and follows the default behavior of [`release-plz`](https://release-plz.dev/docs/config#the-features_always_increment_minor-field). ## [Unreleased] ## [0.89.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.89.2...c2pa-v0.89.3) _13 July 2026_ ### Documented * Fix docs build, take 2 ([#2297](https://github.com/contentauth/c2pa-rs/pull/2297)) * Fix docs build ([#2296](https://github.com/contentauth/c2pa-rs/pull/2296)) ### Fixed * Harden against integer underflow attacks in PNG iTxt chunks XMP parsing ([#2274](https://github.com/contentauth/c2pa-rs/pull/2274)) * Harden against integer overflow attacks in BMFF parser ([#2280](https://github.com/contentauth/c2pa-rs/pull/2280)) * Resource_to_stream returns error for unknown resource URIs instead of manifest JUMBF ([#2289](https://github.com/contentauth/c2pa-rs/pull/2289)) ([#2290](https://github.com/contentauth/c2pa-rs/pull/2290)) ## [0.89.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.89.1...c2pa-v0.89.2) _09 July 2026_ ### Fixed * Bind OCSP response certId to the signing certificate (CAI-11829) ([#2273](https://github.com/contentauth/c2pa-rs/pull/2273)) * Fix new Clippy warnings for Rust 1.97.0 ([#2279](https://github.com/contentauth/c2pa-rs/pull/2279)) * Ensure created has a dst and don't add parent when actions already exist ([#2264](https://github.com/contentauth/c2pa-rs/pull/2264)) * Integer overflow panic in bmff_to_jumbf_exclusions via DataMap offset addition ([#2263](https://github.com/contentauth/c2pa-rs/pull/2263)) ## [0.89.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.89.0...c2pa-v0.89.1) _07 July 2026_ ### Documented * Update README.md doc links ([#2261](https://github.com/contentauth/c2pa-rs/pull/2261)) ### Fixed * Resolve crate audit advisories (lopdf, quick-xml, crossbeam-epoch, ttf-parser) ([#2268](https://github.com/contentauth/c2pa-rs/pull/2268)) * Don't serialize empty values ([#2254](https://github.com/contentauth/c2pa-rs/pull/2254)) * CAI-10364 (Server-Side Request Forgery (SSRF) via CAWG did:web Resolution during Post-Validation ) ([#2168](https://github.com/contentauth/c2pa-rs/pull/2168)) ### Other * Lazy load all ingredient resources & remove old to_archive zip format. ([#2173](https://github.com/contentauth/c2pa-rs/pull/2173)) ## [0.89.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.88.0...c2pa-v0.89.0) _19 June 2026_ ### Added * Add source to `HttpResolverError::Other` error message ([#2237](https://github.com/contentauth/c2pa-rs/pull/2237)) * Auto format detect for Reader ([#2181](https://github.com/contentauth/c2pa-rs/pull/2181)) ### Fixed * Harden JUMBF and JPEG XL parsers against Brotli decompression bombs ([#2210](https://github.com/contentauth/c2pa-rs/pull/2210)) ## [0.88.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.87.0...c2pa-v0.88.0) _11 June 2026_ ### Added * Remove some long deprecated APIs ([#2206](https://github.com/contentauth/c2pa-rs/pull/2206)) ## [0.87.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.86.1...c2pa-v0.87.0) _11 June 2026_ ### Added * [**breaking**] Split c2pa-raw-crypto into its own crate ([#2202](https://github.com/contentauth/c2pa-rs/pull/2202)) ### Fixed * Improve ingredientMismatch error messages ([#2225](https://github.com/contentauth/c2pa-rs/pull/2225)) * Noop test new release workflow ([#2221](https://github.com/contentauth/c2pa-rs/pull/2221)) ### Other * Revert "feat!: Split c2pa-raw-crypto into its own crate ([#2202](https://github.com/contentauth/c2pa-rs/pull/2202))" * Use latest `release-plz` and add a dry run job on release PRs ([#2217](https://github.com/contentauth/c2pa-rs/pull/2217)) ## [0.86.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.86.0...c2pa-v0.86.1) _08 June 2026_ ### Fixed * NOOP PR for release-plz trigger ([#2215](https://github.com/contentauth/c2pa-rs/pull/2215)) ## [0.86.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.85.2...c2pa-v0.86.0) _04 June 2026_ ### Fixed * [**breaking**] Remove unused `Error` variant types ([#2195](https://github.com/contentauth/c2pa-rs/pull/2195)) * Harden additional JUMBF parser sites against integer underflow ([#2201](https://github.com/contentauth/c2pa-rs/pull/2201)) ## [0.85.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.85.1...c2pa-v0.85.2) _03 June 2026_ ### Fixed * Exact ingredient redaction URI matching ([#2203](https://github.com/contentauth/c2pa-rs/pull/2203)) * Harden against integer underflow in JUMBF box parsers ([#2200](https://github.com/contentauth/c2pa-rs/pull/2200)) * Dup redaction ([#2199](https://github.com/contentauth/c2pa-rs/pull/2199)) * Harden against unchecked array index in JUMBF brotli box accessor ([#2192](https://github.com/contentauth/c2pa-rs/pull/2192)) * Make GIF box map C2PA placeholder len 0 rather than 1 ([#2156](https://github.com/contentauth/c2pa-rs/pull/2156)) * Error with validation results on invalid manifest after verify after sign ([#2147](https://github.com/contentauth/c2pa-rs/pull/2147)) ## [0.85.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.85.0...c2pa-v0.85.1) _01 June 2026_ ### Fixed * Preserve validation status log kind after deserialization ([#2162](https://github.com/contentauth/c2pa-rs/pull/2162)) * Declare c2pa XML namespace on SVG root, not manifest tag ([#2113](https://github.com/contentauth/c2pa-rs/pull/2113)) ### Other * Avoid buffering intermediate streams if stream len is greater than threshold ([#2178](https://github.com/contentauth/c2pa-rs/pull/2178)) * Avoid buffering PNG when writing XMP and removing manifest ([#2177](https://github.com/contentauth/c2pa-rs/pull/2177)) ## [0.85.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.84.1...c2pa-v0.85.0) _27 May 2026_ ### Added * Support CAWG callback signing via c_ffi ([#2118](https://github.com/contentauth/c2pa-rs/pull/2118)) ### Fixed * Sync resolver for CAWG web DID ([#2172](https://github.com/contentauth/c2pa-rs/pull/2172)) * Load ingredient manifest store esp. to load resources on search/load miss ([#2164](https://github.com/contentauth/c2pa-rs/pull/2164)) * Share reqwest HTTP clients ([#2152](https://github.com/contentauth/c2pa-rs/pull/2152)) * Improve archive APIs to be able to link archives to actions ([#2095](https://github.com/contentauth/c2pa-rs/pull/2095)) * Use XMP instance_id from source asset in sign and save_to_stream ([#2158](https://github.com/contentauth/c2pa-rs/pull/2158)) * Harden against Builder::base_path injection attack on archive deserialisation ([#2139](https://github.com/contentauth/c2pa-rs/pull/2139)) * Harden against integer overflow attacks in hash_stream_by_alg_with_progress range validation ([#2140](https://github.com/contentauth/c2pa-rs/pull/2140)) ### Other * Skip intermediate stream copy for common signing path ([#2161](https://github.com/contentauth/c2pa-rs/pull/2161)) * Avoid buffering PNG into memory when writing ([#2159](https://github.com/contentauth/c2pa-rs/pull/2159)) * Avoid buffering stream when computing placeholder PNG C2PA chunk ([#2154](https://github.com/contentauth/c2pa-rs/pull/2154)) * Avoid buffering stream when computing placeholder JPEG C2PA chunk ([#2155](https://github.com/contentauth/c2pa-rs/pull/2155)) * Fix lints in newer Rust versions. ([#2153](https://github.com/contentauth/c2pa-rs/pull/2153)) * Optimize signing passes/copies for large PNGs ([#1967](https://github.com/contentauth/c2pa-rs/pull/1967)) * Optimize signing passes/copies for large RIFFs ([#1970](https://github.com/contentauth/c2pa-rs/pull/1970)) * Optimize signing passes/copies for large JPEGs ([#1971](https://github.com/contentauth/c2pa-rs/pull/1971)) * Lazy-load ingredient manifest stores from shared Arc ([#2103](https://github.com/contentauth/c2pa-rs/pull/2103)) * Consolidate embeddable async functions ([#2149](https://github.com/contentauth/c2pa-rs/pull/2149)) * Consolidate async verify functions ([#2146](https://github.com/contentauth/c2pa-rs/pull/2146)) ## [0.84.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.84.0...c2pa-v0.84.1) _12 May 2026_ ### Fixed * Case-insensitive enums in settings to preserve backwards compatibility with `config` crate ([#2138](https://github.com/contentauth/c2pa-rs/pull/2138)) ## [0.84.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.83.0...c2pa-v0.84.0) _11 May 2026_ ### Fixed * Archive preserves duplicate label assertions ([#2135](https://github.com/contentauth/c2pa-rs/pull/2135)) ### Other * [**breaking**] Remove `config` crate and use `serde_json` directly ([#2132](https://github.com/contentauth/c2pa-rs/pull/2132)) ## [0.83.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.82.1...c2pa-v0.83.0) _11 May 2026_ ### Added * Large and complex benchmark suite ([#2116](https://github.com/contentauth/c2pa-rs/pull/2116)) ### Fixed * Reduce allocations in redactions ([#2127](https://github.com/contentauth/c2pa-rs/pull/2127)) * Allow boxes with incomplete content to succeed. ([#2125](https://github.com/contentauth/c2pa-rs/pull/2125)) ### Other * Update `cargo-udeps` setup ([#2047](https://github.com/contentauth/c2pa-rs/pull/2047)) ## [0.82.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.82.0...c2pa-v0.82.1) _04 May 2026_ ### Fixed * Harden against integer underflow attack in GIF XMP validation ([#2099](https://github.com/contentauth/c2pa-rs/pull/2099)) * Harden error code mapping for hash mismatch in validator ([#2101](https://github.com/contentauth/c2pa-rs/pull/2101)) * Update logic for stale thumbnails detection in redaction ([#2107](https://github.com/contentauth/c2pa-rs/pull/2107)) ## [0.82.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.81.0...c2pa-v0.82.0) _01 May 2026_ ### Fixed * Harden against unbounded HTTP response body read in DID web server ([#2070](https://github.com/contentauth/c2pa-rs/pull/2070)) ## [0.81.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.3...c2pa-v0.81.0) _01 May 2026_ ### Added * Make `c2pa_reason` an enum ([#2100](https://github.com/contentauth/c2pa-rs/pull/2100)) ### Fixed * Harden against integer underflow attacks in parsing purpose field in BMFF UUID box ([#2097](https://github.com/contentauth/c2pa-rs/pull/2097)) * Harden against integer overflow attack in png chunk hashing for 32 bit WASM architecture ([#2102](https://github.com/contentauth/c2pa-rs/pull/2102)) * [**breaking**] Use absolute URIs for ingredient thumbnails ([#2098](https://github.com/contentauth/c2pa-rs/pull/2098)) ## [0.80.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.2...c2pa-v0.80.3) _29 April 2026_ ### Added * Support DNG big data ([#2092](https://github.com/contentauth/c2pa-rs/pull/2092)) * Add `init trust`, trust sidecars, and atomic sidecar writes, plus fixes ([#2093](https://github.com/contentauth/c2pa-rs/pull/2093)) ### Updated dependencies * Bump openssl from 0.10.77 to 0.10.78 ([#2082](https://github.com/contentauth/c2pa-rs/pull/2082)) ## [0.80.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.1...c2pa-v0.80.2) _28 April 2026_ ### Documented * Adds redaction docs and example ([#2071](https://github.com/contentauth/c2pa-rs/pull/2071)) ### Fixed * `c2pa-c-ffi` UB detected by miri ([#2089](https://github.com/contentauth/c2pa-rs/pull/2089)) * Harden RSA validators against invalid BER sequences ([#2065](https://github.com/contentauth/c2pa-rs/pull/2065)) * Harden against deep linear ingredient chains with max limits ([#2064](https://github.com/contentauth/c2pa-rs/pull/2064)) * Harden BMFF hash merkel tree creation with max merkel leaves limits ([#2063](https://github.com/contentauth/c2pa-rs/pull/2063)) * Harden against image decompression bomb attacks in building thumbnail ([#2062](https://github.com/contentauth/c2pa-rs/pull/2062)) * Harden tiff parser against forged IFD entry count fields ([#2059](https://github.com/contentauth/c2pa-rs/pull/2059)) * Harden builder and resource store addition against path traversal zip slip attacks ([#2066](https://github.com/contentauth/c2pa-rs/pull/2066)) ## [0.80.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.80.0...c2pa-v0.80.1) _27 April 2026_ ### Fixed * Harden against empty certificates during OCSP certificate validation ([#2067](https://github.com/contentauth/c2pa-rs/pull/2067)) * Prevent duplicate timestamp assertion ([#2085](https://github.com/contentauth/c2pa-rs/pull/2085)) * Harden riff chunk parser against forged size field memory attacks ([#2053](https://github.com/contentauth/c2pa-rs/pull/2053)) * Harden bmff parsing against integer overflow attack ([#2054](https://github.com/contentauth/c2pa-rs/pull/2054)) * Harden against cyclic IFD chain in tiff parser ([#2068](https://github.com/contentauth/c2pa-rs/pull/2068)) ## [0.80.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.5...c2pa-v0.80.0) _16 April 2026_ ### Added * Add ingredient archive FFI functions and relax Builder mutability ([#2061](https://github.com/contentauth/c2pa-rs/pull/2061)) * Compressed manifest ([#2027](https://github.com/contentauth/c2pa-rs/pull/2027)) ### Documented * Separate out C docs ([#2052](https://github.com/contentauth/c2pa-rs/pull/2052)) ### Fixed * Multi rendition support ([#2058](https://github.com/contentauth/c2pa-rs/pull/2058)) ## [0.79.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.4...c2pa-v0.79.5) _15 April 2026_ ### Fixed * Handle more thumbnail redaction edge cases ([#2049](https://github.com/contentauth/c2pa-rs/pull/2049)) ## [0.79.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.3...c2pa-v0.79.4) _14 April 2026_ ### Fixed * Run cargo fmt ([#2046](https://github.com/contentauth/c2pa-rs/pull/2046)) * Wrap Error::NotImplemented in Err() for wasip1 tempfile_builder ([#2037](https://github.com/contentauth/c2pa-rs/pull/2037)) * Limit the maximum number of assertions allowed for C2PA Manifest ([#1951](https://github.com/contentauth/c2pa-rs/pull/1951)) ## [0.79.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.2...c2pa-v0.79.3) _09 April 2026_ ### Added * *(sdk)* Ingredient JUMBF archives, archive metadata typing ([#2007](https://github.com/contentauth/c2pa-rs/pull/2007)) ### Fixed * Redaction follow-up fix ([#2030](https://github.com/contentauth/c2pa-rs/pull/2030)) ## [0.79.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.1...c2pa-v0.79.2) _08 April 2026_ ### Fixed * Harden against integer overflow panic in big tiff processing ([#2012](https://github.com/contentauth/c2pa-rs/pull/2012)) * Harden against integer underflow panic in assertion label parsing ([#2013](https://github.com/contentauth/c2pa-rs/pull/2013)) * Harden assertion label URI parsing logic to fix index out of bounds access ([#2018](https://github.com/contentauth/c2pa-rs/pull/2018)) * Harden BMFF hash merkle validation via count/range mismatch ([#2019](https://github.com/contentauth/c2pa-rs/pull/2019)) * Harden BmffHash timed media chunk verification against out of bounds access issue ([#2020](https://github.com/contentauth/c2pa-rs/pull/2020)) * Harden BMFF Merkle maps processing logic to avoid panic ([#2021](https://github.com/contentauth/c2pa-rs/pull/2021)) * Harden against invalid MP4 files during BmffHash timed-media chunk mapping ([#2022](https://github.com/contentauth/c2pa-rs/pull/2022)) * Redact thumbnails when ingredient with thumbnails added through add_ingredient is being thumbnail-redacted too ([#2016](https://github.com/contentauth/c2pa-rs/pull/2016)) * Allow any file type to be signed with a sidecar ([#2014](https://github.com/contentauth/c2pa-rs/pull/2014)) ## [0.79.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.79.0...c2pa-v0.79.1) _07 April 2026_ ### Fixed * Redact thumbnails in databoxes (v1 claims) ([#2015](https://github.com/contentauth/c2pa-rs/pull/2015)) ## [0.79.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.8...c2pa-v0.79.0) _03 April 2026_ ### Fixed * Redacting things in multiple ingredients ([#2009](https://github.com/contentauth/c2pa-rs/pull/2009)) * Adds more granular progress for validation ([#2006](https://github.com/contentauth/c2pa-rs/pull/2006)) * [**breaking**] Disable HTTP redirects in restricted networking implementation ([#1907](https://github.com/contentauth/c2pa-rs/pull/1907)) ## [0.78.8](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.7...c2pa-v0.78.8) _31 March 2026_ ### Added * Expose a C FFI API to help determine the hashtype a Builder uses with embeddable APIs ([#1992](https://github.com/contentauth/c2pa-rs/pull/1992)) * Add support for JPEG XL file format ([#1870](https://github.com/contentauth/c2pa-rs/pull/1870)) ### Fixed * Switch to Firefox for CI web tests ([#1999](https://github.com/contentauth/c2pa-rs/pull/1999)) ### Other * Fix clippy lints ([#1996](https://github.com/contentauth/c2pa-rs/pull/1996)) ## [0.78.7](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.6...c2pa-v0.78.7) _27 March 2026_ ### Added * Adds a progress/cancel feature to Context for the c2pa-rs sdk ([#1927](https://github.com/contentauth/c2pa-rs/pull/1927)) ### Fixed * Harden JUMB embed media description box parser against integer underflow attack ([#1950](https://github.com/contentauth/c2pa-rs/pull/1950)) * Harden JUMB description box parser against integer underflow attack ([#1949](https://github.com/contentauth/c2pa-rs/pull/1949)) * Harden JUMBF nested box parsing against stack overflow attack ([#1966](https://github.com/contentauth/c2pa-rs/pull/1966)) * Harden BMFF Merkle tree hash processing code against integer underflow attack ([#1963](https://github.com/contentauth/c2pa-rs/pull/1963)) * Updated crJSON Schema ([#1975](https://github.com/contentauth/c2pa-rs/pull/1975)) * TIFF backcompatibility for RAW formats ([#1976](https://github.com/contentauth/c2pa-rs/pull/1976)) * Check for malicious recursion ([#1979](https://github.com/contentauth/c2pa-rs/pull/1979)) ## [0.78.6](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.5...c2pa-v0.78.6) _23 March 2026_ ### Added * Add FLAC format support ([#1912](https://github.com/contentauth/c2pa-rs/pull/1912)) ## [0.78.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.4...c2pa-v0.78.5) _23 March 2026_ ### Added * Add `cr_json()` and `cr_json_value()` to `Reader`; remove separate `CrJsonReader` ([#1919](https://github.com/contentauth/c2pa-rs/pull/1919)) ### Fixed * Add compatibility for source assets that report mdat box sizes that e… ([#1956](https://github.com/contentauth/c2pa-rs/pull/1956)) * Change `Builder::add_action` to add original actions or v2 actions ([#1946](https://github.com/contentauth/c2pa-rs/pull/1946)) ## [0.78.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.3...c2pa-v0.78.4) _16 March 2026_ ### Fixed * Pin `atree` to 0.5.2 ([#1940](https://github.com/contentauth/c2pa-rs/pull/1940)) * Remove exponential memory growth from nested claim reconstruction ([#1885](https://github.com/contentauth/c2pa-rs/pull/1885)) ([#1887](https://github.com/contentauth/c2pa-rs/pull/1887)) ## [0.78.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.2...c2pa-v0.78.3) _13 March 2026_ ### Added * Impl `Send + Sync` on `EphemeralSigner` ([#1934](https://github.com/contentauth/c2pa-rs/pull/1934)) ### Fixed * Apply same restrictions on ingredient deltas as active manifest for validation state ([#1624](https://github.com/contentauth/c2pa-rs/pull/1624)) ## [0.78.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.1...c2pa-v0.78.2) _12 March 2026_ ### Fixed * Windows Build flags ([#1930](https://github.com/contentauth/c2pa-rs/pull/1930)) ## [0.78.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.78.0...c2pa-v0.78.1) _12 March 2026_ ### Fixed * Fragmented video verification ([#1925](https://github.com/contentauth/c2pa-rs/pull/1925)) ## [0.78.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.77.1...c2pa-v0.78.0) _11 March 2026_ ### Added * Emscripten ([#1886](https://github.com/contentauth/c2pa-rs/pull/1886)) ### Fixed * Correct validation of OCSP signature ([#1863](https://github.com/contentauth/c2pa-rs/pull/1863)) * Merkle api integration ([#1902](https://github.com/contentauth/c2pa-rs/pull/1902)) ## [0.77.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.77.0...c2pa-v0.77.1) _10 March 2026_ ### Documented * Combine docs on Context and Settings to reduce duplication ([#1899](https://github.com/contentauth/c2pa-rs/pull/1899)) ## [0.77.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.76.2...c2pa-v0.77.0) _04 March 2026_ ### Added * Embeddable manifest API with Context/Settings, CAWG and BMFF.v3 support. ([#1847](https://github.com/contentauth/c2pa-rs/pull/1847)) ## [0.76.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.76.1...c2pa-v0.76.2) _03 March 2026_ ### Fixed * Panic when validating boxes hash with no names ([#1897](https://github.com/contentauth/c2pa-rs/pull/1897)) ## [0.76.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.76.0...c2pa-v0.76.1) _02 March 2026_ ### Fixed * Handle meta box without FullBox header from Apple devices ([#1889](https://github.com/contentauth/c2pa-rs/pull/1889)) ### Updated dependencies * Bump png_pong from 0.9.3 to 0.10.0 ([#1850](https://github.com/contentauth/c2pa-rs/pull/1850)) * Bump toml from 0.9.12+spec-1.1.0 to 1.0.2+spec-1.1.0 ([#1883](https://github.com/contentauth/c2pa-rs/pull/1883)) ## [0.76.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.21...c2pa-v0.76.0) _23 February 2026_ ### Added * Enable self-signed ephemeral certs on Wasm build ([#1858](https://github.com/contentauth/c2pa-rs/pull/1858)) ### Documented * Fix doc for verify_after_sign due to bug ([#1876](https://github.com/contentauth/c2pa-rs/pull/1876)) * Doc cleanup and some reorg ([#1822](https://github.com/contentauth/c2pa-rs/pull/1822)) * SignerSettings doc comments ([#1856](https://github.com/contentauth/c2pa-rs/pull/1856)) ### Fixed * Use cose_sign1 signature field for timestamp assertion verification ([#1867](https://github.com/contentauth/c2pa-rs/pull/1867)) * [**breaking**] Allow `Builder::sign_async` future to be spawnable on Tokio runtime ([#1846](https://github.com/contentauth/c2pa-rs/pull/1846)) ### Updated dependencies * Bump zip from 7.4.0 to 8.1.0 ([#1864](https://github.com/contentauth/c2pa-rs/pull/1864)) * Bump zip from 6.0.0 to 7.4.0 ([#1857](https://github.com/contentauth/c2pa-rs/pull/1857)) ## [0.75.21](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.20...c2pa-v0.75.21) _12 February 2026_ No-op re-release to address previous build failure. ## [0.75.20](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.19...c2pa-v0.75.20) _12 February 2026_ ### Added * Use ephemeral self-signed cert to sign working store / archive ([#1839](https://github.com/contentauth/c2pa-rs/pull/1839)) ## [0.75.19](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.18...c2pa-v0.75.19) _09 February 2026_ ### Fixed * Support QT style 'meta' boxes ([#1844](https://github.com/contentauth/c2pa-rs/pull/1844)) * Settings.builder.created_assertion_lables was not being applied. ([#1828](https://github.com/contentauth/c2pa-rs/pull/1828)) ## [0.75.18](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.17...c2pa-v0.75.18) _06 February 2026_ ### Fixed * Wrong size being written out for XMP box ([#1835](https://github.com/contentauth/c2pa-rs/pull/1835)) ## [0.75.17](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.16...c2pa-v0.75.17) _06 February 2026_ ### Fixed * Capture default values in schema generation ([#1824](https://github.com/contentauth/c2pa-rs/pull/1824)) ## [0.75.13](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.12...c2pa-v0.75.13) _03 February 2026_ ### Fixed * Force Cargo to use sparse crates.io index ## [0.75.12](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.11...c2pa-v0.75.12) _03 February 2026_ (Re-release since the 0.75.11 release failed.) ## [0.75.11](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.10...c2pa-v0.75.11) _03 February 2026_ ### Added * Adds thread safe Settings and Context support to c_ffi_api ([#1783](https://github.com/contentauth/c2pa-rs/pull/1783)) ### Other * Only use `reqwest` for `c2pa-c-ffi` networking ([#1807](https://github.com/contentauth/c2pa-rs/pull/1807)) ### Updated dependencies * Bump jumbf from 0.5.0 to 0.7.0 ([#1806](https://github.com/contentauth/c2pa-rs/pull/1806)) ## [0.75.10](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.9...c2pa-v0.75.10) _02 February 2026_ ### Fixed * Updates to c2pa_cbor 0.77.2 ([#1804](https://github.com/contentauth/c2pa-rs/pull/1804)) ### Updated dependencies * Bump jumbf from 0.4.1 to 0.5.0 ([#1794](https://github.com/contentauth/c2pa-rs/pull/1794)) ## [0.75.9](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.8...c2pa-v0.75.9) _30 January 2026_ ### Added * Public API for timestamp assertions ([#1603](https://github.com/contentauth/c2pa-rs/pull/1603)) * Add support for arbitrary key/value pairs in assertion metadata ([#1782](https://github.com/contentauth/c2pa-rs/pull/1782)) ### Updated dependencies * Bump c2pa-cbor from 0.77.0 to 0.77.1 ([#1800](https://github.com/contentauth/c2pa-rs/pull/1800)) ## [0.75.8](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.7...c2pa-v0.75.8) _28 January 2026_ ### Fixed * MP3's GEOB MIME type ([#1790](https://github.com/contentauth/c2pa-rs/pull/1790)) * Removed dependency on unmaintained `serde_cbor` crate ([#1739](https://github.com/contentauth/c2pa-rs/pull/1739)) ## [0.75.7](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.6...c2pa-v0.75.7) _27 January 2026_ ### Fixed * Retrigger release-plz release workflow ([#1781](https://github.com/contentauth/c2pa-rs/pull/1781)) ## [0.75.6](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.5...c2pa-v0.75.6) _22 January 2026_ ### Added * Trigger a new release to allow generated binaries to be published ## [0.75.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.4...c2pa-v0.75.5) _21 January 2026_ ### Fixed * Use patched version of typed-path for zip ([#1761](https://github.com/contentauth/c2pa-rs/pull/1761)) * Work around compilation issues introduced by `typed_path` crate ([#1757](https://github.com/contentauth/c2pa-rs/pull/1757)) * Update tiff support to latest standard ([#1736](https://github.com/contentauth/c2pa-rs/pull/1736)) ### Updated dependencies * Bump quick-xml from 0.38.4 to 0.39.0 ([#1754](https://github.com/contentauth/c2pa-rs/pull/1754)) * Bump lopdf from 0.38.0 to 0.39.0 ([#1753](https://github.com/contentauth/c2pa-rs/pull/1753)) ## [0.75.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.3...c2pa-v0.75.4) _16 January 2026_ ### Fixed * Context propagation for Reader to support legacy behavior ([#1743](https://github.com/contentauth/c2pa-rs/pull/1743)) ## [0.75.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.2...c2pa-v0.75.3) _16 January 2026_ ### Documented * Describe what parameter is missing in c2pa.opened/placed/removed validation ([#1737](https://github.com/contentauth/c2pa-rs/pull/1737)) ### Fixed * Disable verify after sign temporarily (due to bug) ([#1746](https://github.com/contentauth/c2pa-rs/pull/1746)) ## [0.75.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.1...c2pa-v0.75.2) _15 January 2026_ ### Fixed * Fix streams handling for TIFF ([#1728](https://github.com/contentauth/c2pa-rs/pull/1728)) ## [0.75.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.75.0...c2pa-v0.75.1) _15 January 2026_ ### Added * Report claim version in manifest report ([#1722](https://github.com/contentauth/c2pa-rs/pull/1722)) ### Fixed * Verify after sign not executing ([#1638](https://github.com/contentauth/c2pa-rs/pull/1638)) ### Updated dependencies * Bump img-parts from 0.3.3 to 0.4.0 ([#1733](https://github.com/contentauth/c2pa-rs/pull/1733)) * Bump range-set from 0.0.11 to 0.1.0 ([#1726](https://github.com/contentauth/c2pa-rs/pull/1726)) * Bump nonempty-collections from 0.3.1 to 1.2.1 ([#1724](https://github.com/contentauth/c2pa-rs/pull/1724)) * Bump extfmt from 0.1.1 to 0.2.0 ([#1725](https://github.com/contentauth/c2pa-rs/pull/1725)) * Bump zip from 6.0.0 to 7.0.0 ([#1723](https://github.com/contentauth/c2pa-rs/pull/1723)) ## [0.75.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.74.0...c2pa-v0.75.0) _14 January 2026_ ### Added * Deeper integration of Context into the SDK ([#1710](https://github.com/contentauth/c2pa-rs/pull/1710)) * Multi RIFF AVI (AVIX) support ([#1656](https://github.com/contentauth/c2pa-rs/pull/1656)) * Add `Manifest::signature` to get Cose_Sign1 signature ([#1699](https://github.com/contentauth/c2pa-rs/pull/1699)) ### Fixed * CAI-10286 - path traversal, zip-slip in from_archive ([#1721](https://github.com/contentauth/c2pa-rs/pull/1721)) * 1716 fix deeply nested bmff box issue ([#1717](https://github.com/contentauth/c2pa-rs/pull/1717)) * Fix vulnerability with user supplied exclusions. ([#1715](https://github.com/contentauth/c2pa-rs/pull/1715)) * Make parameters optional for transcoded and repackaged actions ([#1701](https://github.com/contentauth/c2pa-rs/pull/1701)) * Allow actions assertions to be created assertions ([#1703](https://github.com/contentauth/c2pa-rs/pull/1703)) ### Updated dependencies * Bump non-empty-string from 0.2.4 to 0.2.6 ([#1720](https://github.com/contentauth/c2pa-rs/pull/1720)) * Bump id3 from 1.16.1 to 1.16.3 ([#1718](https://github.com/contentauth/c2pa-rs/pull/1718)) * Bump asn1-rs from 0.6.2 to 0.7.1 ([#1505](https://github.com/contentauth/c2pa-rs/pull/1505)) * Bump toml from 0.8.23 to 0.9.10+spec-1.1.0 ([#1713](https://github.com/contentauth/c2pa-rs/pull/1713)) * Bump env_logger from 0.10.2 to 0.11.8 ([#1711](https://github.com/contentauth/c2pa-rs/pull/1711)) * Bump rasn from 0.26.6 to 0.28.1 ([#1621](https://github.com/contentauth/c2pa-rs/pull/1621)) * Bump rand_chacha from 0.3.1 to 0.9.0 ([#1619](https://github.com/contentauth/c2pa-rs/pull/1619)) * Bump mockall from 0.13.1 to 0.14.0 ([#1708](https://github.com/contentauth/c2pa-rs/pull/1708)) ## [0.74.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.73.2...c2pa-v0.74.0) _07 January 2026_ ### Added * [**breaking**] Store `Context` as `Arc` for shared context and threading support ([#1680](https://github.com/contentauth/c2pa-rs/pull/1680)) * Add CAWG roles support to SignerSettings ([#1700](https://github.com/contentauth/c2pa-rs/pull/1700)) * Adds `Context` to contain settings, HTTPS resolvers, and signers ([#1631](https://github.com/contentauth/c2pa-rs/pull/1631)) ### Fixed * Hard binding recursive search for nested update manifests ([#1693](https://github.com/contentauth/c2pa-rs/pull/1693)) ### Other * Update `codspeed-criterion-compat` to 4.2.1 ([#1702](https://github.com/contentauth/c2pa-rs/pull/1702)) ### Updated dependencies * Bump rsa from 0.9.9 to 0.9.10 ([#1698](https://github.com/contentauth/c2pa-rs/pull/1698)) ## [0.73.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.73.1...c2pa-v0.73.2) _22 December 2025_ ### Fixed * Nested ingredient serializing-deserializing (fix for #1685) ([#1686](https://github.com/contentauth/c2pa-rs/pull/1686)) * Flush stream to finish write operations before rewind for FFI layer improvements ([#1672](https://github.com/contentauth/c2pa-rs/pull/1672)) ## [0.73.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.73.0...c2pa-v0.73.1) _19 December 2025_ ### Fixed * Fix case where UUID boxes and BMFF layout confused the insertion ([#1676](https://github.com/contentauth/c2pa-rs/pull/1676)) * Remove extra hash binding verification for update manifests ([#1659](https://github.com/contentauth/c2pa-rs/pull/1659)) * Add maybeSync ([#1664](https://github.com/contentauth/c2pa-rs/pull/1664)) * Address new warnings with Rust 1.92.0 ([#1661](https://github.com/contentauth/c2pa-rs/pull/1661)) ### Other * Replace once_cell Lazy with std LazyLock ([#1666](https://github.com/contentauth/c2pa-rs/pull/1666)) ## [0.73.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.72.1...c2pa-v0.73.0) _04 December 2025_ ### Added * Restricted HTTP resolvers ([#1630](https://github.com/contentauth/c2pa-rs/pull/1630)) ## [0.72.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.72.0...c2pa-v0.72.1) _04 December 2025_ ### Added * Check if stream matches input format via file signature/structure ([#1528](https://github.com/contentauth/c2pa-rs/pull/1528)) * Use MaybeSend to simplify code ([#1639](https://github.com/contentauth/c2pa-rs/pull/1639)) ### Documented * Add doc for CLI settings, misc copy edits ([#1636](https://github.com/contentauth/c2pa-rs/pull/1636)) ### Fixed * Set wasm-bindgen-cli version in CI ([#1644](https://github.com/contentauth/c2pa-rs/pull/1644)) * Fix the timestamp cert chain validation to be independent of the order ([#1600](https://github.com/contentauth/c2pa-rs/pull/1600)) * RFC 3161 fractional seconds ([#1640](https://github.com/contentauth/c2pa-rs/pull/1640)) * Stack overflow and hang due to cyclic ingredients ([#1576](https://github.com/contentauth/c2pa-rs/pull/1576)) * Allow untrusted failure code to be a `Valid` validation state ([#1623](https://github.com/contentauth/c2pa-rs/pull/1623)) * Remove unmaintained `json5` dependency and other unused `config` crate sub-dependencies ([#1611](https://github.com/contentauth/c2pa-rs/pull/1611)) ### Other * Remove direct dependency on `windows-core` ([#1616](https://github.com/contentauth/c2pa-rs/pull/1616)) ### Updated dependencies * Bump lopdf from 0.31.0 to 0.38.0 ([#1359](https://github.com/contentauth/c2pa-rs/pull/1359)) * Bump quick-xml from 0.37.5 to 0.38.3 ([#1575](https://github.com/contentauth/c2pa-rs/pull/1575)) ## [0.72.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.3...c2pa-v0.72.0) _17 November 2025_ ### Added * Remove x509_certificate ([#1547](https://github.com/contentauth/c2pa-rs/pull/1547)) ### Fixed * Remove ring altogether ([#1606](https://github.com/contentauth/c2pa-rs/pull/1606)) ## [0.71.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.2...c2pa-v0.71.3) _17 November 2025_ ### Documented * Fix and update Builder examples ([#1484](https://github.com/contentauth/c2pa-rs/pull/1484)) ## [0.71.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.1...c2pa-v0.71.2) _13 November 2025_ ### Fixed * Remove a dbg statement ([#1594](https://github.com/contentauth/c2pa-rs/pull/1594)) ## [0.71.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.71.0...c2pa-v0.71.1) _12 November 2025_ ### Fixed * Use Digitalsourcetype with Builder intents ([#1586](https://github.com/contentauth/c2pa-rs/pull/1586)) * Restore recursive ingredient checks ([#1582](https://github.com/contentauth/c2pa-rs/pull/1582)) ## [0.71.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.70.0...c2pa-v0.71.0) _07 November 2025_ ### Fixed * Disallow ureq and reqwest_blocking for WASM and WASI ([#1579](https://github.com/contentauth/c2pa-rs/pull/1579)) ## [0.70.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.69.0...c2pa-v0.70.0) _06 November 2025_ ### Added * Sync/async HTTP resolvers API ([#1355](https://github.com/contentauth/c2pa-rs/pull/1355)) ### Fixed * Better support for remote-only manifests of non-BMFF assets ([#1569](https://github.com/contentauth/c2pa-rs/pull/1569)) ### Updated dependencies * Bump thiserror from 1.0.69 to 2.0.17 ([#1562](https://github.com/contentauth/c2pa-rs/pull/1562)) ## [0.69.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.68.0...c2pa-v0.69.0) _04 November 2025_ ### Added * Refine validation state logic ([#1541](https://github.com/contentauth/c2pa-rs/pull/1541)) * Adds support and documentation for JSON formatted Settings ([#1533](https://github.com/contentauth/c2pa-rs/pull/1533)) * Allow reading a manifest store as a Builder to continue editing ([#1476](https://github.com/contentauth/c2pa-rs/pull/1476)) ### Fixed * Allow C2PA archives to be unsigned ([#1560](https://github.com/contentauth/c2pa-rs/pull/1560)) * Add JsonSchema to Action ([#1550](https://github.com/contentauth/c2pa-rs/pull/1550)) * Update to avoid deprecation warning for Command::cargo_bin ([#1548](https://github.com/contentauth/c2pa-rs/pull/1548)) ### Updated dependencies * Bump zip from 3.0.0 to 6.0.0 ([#1540](https://github.com/contentauth/c2pa-rs/pull/1540)) * Bump coset from 0.3.8 to 0.4.0 ([#1539](https://github.com/contentauth/c2pa-rs/pull/1539)) * Bump hex-literal from 0.4.1 to 1.0.0 ([#1527](https://github.com/contentauth/c2pa-rs/pull/1527)) ## [0.68.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.67.1...c2pa-v0.68.0) _24 October 2025_ ### Added * Add settings structs to the public API ([#1447](https://github.com/contentauth/c2pa-rs/pull/1447)) * Enables generating created assertions and getting the created state ([#1432](https://github.com/contentauth/c2pa-rs/pull/1432)) * Make settings not thread-local ([#1444](https://github.com/contentauth/c2pa-rs/pull/1444)) * Add CAWG validation to `Reader` ([#1370](https://github.com/contentauth/c2pa-rs/pull/1370)) ### Documented * Document features in Rust docs and clarify features ([#1491](https://github.com/contentauth/c2pa-rs/pull/1491)) * Say to use v2 claims. Update support statement ([#1496](https://github.com/contentauth/c2pa-rs/pull/1496)) * Update README.md to add CAI membership & Discord links ([#1482](https://github.com/contentauth/c2pa-rs/pull/1482)) * Fix docs.rs build by removing removed features ([#1480](https://github.com/contentauth/c2pa-rs/pull/1480)) ### Fixed * Change MSRV to 1.88.0 ([#1520](https://github.com/contentauth/c2pa-rs/pull/1520)) * Timestamp grace for legacy manifests ([#1502](https://github.com/contentauth/c2pa-rs/pull/1502)) * Skip test_reader_to_folder in github workflow for WASI ([#1498](https://github.com/contentauth/c2pa-rs/pull/1498)) * Remove `serialize_thumbnails` feature ([#1492](https://github.com/contentauth/c2pa-rs/pull/1492)) * Don't log OCSP status if the result cannot be validated. ([#1489](https://github.com/contentauth/c2pa-rs/pull/1489)) * Expose underlying timestamp assertion support ([#1371](https://github.com/contentauth/c2pa-rs/pull/1371)) * Turn on trust by default ([#1483](https://github.com/contentauth/c2pa-rs/pull/1483)) * Empty actions array should be allowed for v1 claim compatibility [CAI-9573] ([#1477](https://github.com/contentauth/c2pa-rs/pull/1477)) * Add support for new data hash exclusions when update manifests are pr… ([#1478](https://github.com/contentauth/c2pa-rs/pull/1478)) ### Other * Update httpmock to 0.8.0 ([#1472](https://github.com/contentauth/c2pa-rs/pull/1472)) ### Updated dependencies * Bump memchr from 2.7.5 to 2.7.6 ([#1516](https://github.com/contentauth/c2pa-rs/pull/1516)) * Bump schemars from 0.8.22 to 1.0.4 ([#1247](https://github.com/contentauth/c2pa-rs/pull/1247)) * Bump pem from 3.0.5 to 3.0.6 ([#1511](https://github.com/contentauth/c2pa-rs/pull/1511)) * Bump serde_with from 3.14.0 to 3.15.1 ([#1503](https://github.com/contentauth/c2pa-rs/pull/1503)) * Bump httpmock from 0.8.1 to 0.8.2 ([#1504](https://github.com/contentauth/c2pa-rs/pull/1504)) ## [0.67.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.67.0...c2pa-v0.67.1) _02 October 2025_ ### Fixed * Mark `DigitalSourceType` fields as deprecated without warning (new serde update) ([#1427](https://github.com/contentauth/c2pa-rs/pull/1427)) * Correct the payload of claim signature box when calculating the hash. ([#1466](https://github.com/contentauth/c2pa-rs/pull/1466)) ## [0.67.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.66.0...c2pa-v0.67.0) _30 September 2025_ ### Fixed * Do not generate multiple `c2pa.placed` actions with settings ([#1458](https://github.com/contentauth/c2pa-rs/pull/1458)) * AllActionsIncluded defaults to None ([#1459](https://github.com/contentauth/c2pa-rs/pull/1459)) ### Other * Fix pdf benchmarks ([#1452](https://github.com/contentauth/c2pa-rs/pull/1452)) ## [0.66.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.65.1...c2pa-v0.66.0) _24 September 2025_ ### Fixed * We lost the ability to read the deprecated instanceId actions parameters field. ([#1443](https://github.com/contentauth/c2pa-rs/pull/1443)) * Remove `no_interleaved_io` feature ([#1437](https://github.com/contentauth/c2pa-rs/pull/1437)) ## [0.65.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.65.0...c2pa-v0.65.1) _23 September 2025_ ### Fixed * Add support for iso6 boxes (tfra, tfhd and saio) ([#1442](https://github.com/contentauth/c2pa-rs/pull/1442)) * [CAI-9586] Some validation errors are thrown as exceptions ([#1441](https://github.com/contentauth/c2pa-rs/pull/1441)) * Only enable "asm" feature on aarch64 macos ([#1440](https://github.com/contentauth/c2pa-rs/pull/1440)) ## [0.65.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.64.0...c2pa-v0.65.0) _19 September 2025_ ### Added * Expose add_action from the Builder at the C level ([#1425](https://github.com/contentauth/c2pa-rs/pull/1425)) * Add Redaction and Update manifest support to Builder ([#1180](https://github.com/contentauth/c2pa-rs/pull/1180)) * Add `ParametersMap` to `Actions` ([#1274](https://github.com/contentauth/c2pa-rs/pull/1274)) * *(sdk)* Introduce new API to retrieve detailed manifest JSON ([#1406](https://github.com/contentauth/c2pa-rs/pull/1406)) ## [0.64.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.63.0...c2pa-v0.64.0) _15 September 2025_ ### Added * Fetch OCSP wasm ([#1402](https://github.com/contentauth/c2pa-rs/pull/1402)) ### Fixed * Allow v1 claim c2pa.manifest cbor assertions without full valid… ([#1412](https://github.com/contentauth/c2pa-rs/pull/1412)) ## [0.63.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.62.0...c2pa-v0.63.0) _10 September 2025_ ### Added * Add `cawg_trust.verify_trust_list` setting ([#1356](https://github.com/contentauth/c2pa-rs/pull/1356)) * Remove the v1_api feature and all associated code ([#1387](https://github.com/contentauth/c2pa-rs/pull/1387)) ### Fixed * Fix/trust list check ([#1398](https://github.com/contentauth/c2pa-rs/pull/1398)) * Remove unmaintained dependencies conv and custom_derive ([#1393](https://github.com/contentauth/c2pa-rs/pull/1393)) ## [0.62.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.61.0...c2pa-v0.62.0) _06 September 2025_ ### Added * Implement CAWG X.509 signing via settings ([#1388](https://github.com/contentauth/c2pa-rs/pull/1388)) ### Fixed * Assertion metadata localizations support was missing. CAI-9444 ([#1390](https://github.com/contentauth/c2pa-rs/pull/1390)) * Make `openssl` and `rust_native_crypto` features additive ([#1379](https://github.com/contentauth/c2pa-rs/pull/1379)) * Make OpenSSL code path enforce COSE specified salt length ([#1376](https://github.com/contentauth/c2pa-rs/pull/1376)) ## [0.61.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.60.1...c2pa-v0.61.0) _03 September 2025_ ### Added * Add benchmarking ([#1311](https://github.com/contentauth/c2pa-rs/pull/1311)) ### Fixed * Rewind output stream after adding dynamic assertions ([#1358](https://github.com/contentauth/c2pa-rs/pull/1358)) * Fix label handling for custom metadata ([#1354](https://github.com/contentauth/c2pa-rs/pull/1354)) * Gif global color table size ([#1348](https://github.com/contentauth/c2pa-rs/pull/1348)) * Fix overly agressive metata collection ([#1345](https://github.com/contentauth/c2pa-rs/pull/1345)) ## [0.60.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.60.0...c2pa-v0.60.1) _27 August 2025_ ### Fixed * Removes asm feature for sha2 ([#1343](https://github.com/contentauth/c2pa-rs/pull/1343)) * Reset settings after test_stream_thumbnail ([#1339](https://github.com/contentauth/c2pa-rs/pull/1339)) ## [0.60.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.59.1...c2pa-v0.60.0) _26 August 2025_ ### Added * *(sdk)* Falls back to fs for large intermediate streams ([#1341](https://github.com/contentauth/c2pa-rs/pull/1341)) * Add ability to set/get the description for an action. ([#1276](https://github.com/contentauth/c2pa-rs/pull/1276)) ### Fixed * Ingredient thumbnail generation respect settings ([#1332](https://github.com/contentauth/c2pa-rs/pull/1332)) * Fix a regression for invalid manifest handling and reader creation ([#1312](https://github.com/contentauth/c2pa-rs/pull/1312)) * Fix test ### Other * Fix docs and dead code lint ([#1340](https://github.com/contentauth/c2pa-rs/pull/1340)) ## [0.59.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.59.0...c2pa-v0.59.1) _15 August 2025_ ### Fixed * Add common name to manifest dump ([#1319](https://github.com/contentauth/c2pa-rs/pull/1319)) * Support box hash exclusions ([#1317](https://github.com/contentauth/c2pa-rs/pull/1317)) # Changelog All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html), except that – as is typical in the Rust community – the minimum supported Rust version may be increased without a major version increase. Since version 0.36.2, the format of this changelog is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [0.59.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.58.0...c2pa-v0.59.0) _14 August 2025_ ### Added * Add option for configuring trust when validating identity assertions (CAI-7980) ([#1239](https://github.com/contentauth/c2pa-rs/pull/1239)) * Add new soft binding fields to the ingredient assertion structure ([#1306](https://github.com/contentauth/c2pa-rs/pull/1306)) * Add cawg.metadata label and test. ([#1305](https://github.com/contentauth/c2pa-rs/pull/1305)) * Certificate status assertion ([#1236](https://github.com/contentauth/c2pa-rs/pull/1236)) * Browser wasm fetch remote manifests ([#1259](https://github.com/contentauth/c2pa-rs/pull/1259)) * Define `DigitalSourceType` as enum ([#1260](https://github.com/contentauth/c2pa-rs/pull/1260)) * Impl Soft Binding assertion definition ([#1147](https://github.com/contentauth/c2pa-rs/pull/1147)) * Add metadata assertion and support for validation ([#1258](https://github.com/contentauth/c2pa-rs/pull/1258)) * Remove `Send` trait for `CAIRead` on Wasm ([#1264](https://github.com/contentauth/c2pa-rs/pull/1264)) * [**breaking**] Change `Verifier` to hold a `Cow<'a, CertificateTrustPolicy` rather than a reference ([#1238](https://github.com/contentauth/c2pa-rs/pull/1238)) * V2 Claims are now generated by default ([#1266](https://github.com/contentauth/c2pa-rs/pull/1266)) * Bump MSRV to 1.86.0 ([#1269](https://github.com/contentauth/c2pa-rs/pull/1269)) * Expand settings API ([#1192](https://github.com/contentauth/c2pa-rs/pull/1192)) ### Fixed * Fix broken ingredient recursion ([#1309](https://github.com/contentauth/c2pa-rs/pull/1309)) * Mark the CreativeWork assertion as deprecated ([#1304](https://github.com/contentauth/c2pa-rs/pull/1304)) * Make common name available to manifest_store ([#1300](https://github.com/contentauth/c2pa-rs/pull/1300)) * V2 redactions were reporting validation error if the assertion was redacted ([#1282](https://github.com/contentauth/c2pa-rs/pull/1282)) * Bmff update manifest support ([#1284](https://github.com/contentauth/c2pa-rs/pull/1284)) * Report correct identity assertion JUMBF URI when reporting validation status ([#1292](https://github.com/contentauth/c2pa-rs/pull/1292)) * Support for BMFF V3 hashing options ([#1253](https://github.com/contentauth/c2pa-rs/pull/1253)) * Remove "other" field in `Metadata` assertion ([#1251](https://github.com/contentauth/c2pa-rs/pull/1251)) * Add support for m4v ([#1254](https://github.com/contentauth/c2pa-rs/pull/1254)) ### Other * Rename Metadata to AssertionMetadata ([#1261](https://github.com/contentauth/c2pa-rs/pull/1261)) * Feature flag `test_reader_remote_url` with feature `fetch_remote_manifests` ([#1252](https://github.com/contentauth/c2pa-rs/pull/1252)) ## [0.58.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.57.0...c2pa-v0.58.0) _18 July 2025_ ### Added * Add C binding for setting the base path ([#1237](https://github.com/contentauth/c2pa-rs/pull/1237)) * Asset reference assertion ([#1203](https://github.com/contentauth/c2pa-rs/pull/1203)) * Add `Reader::remote_url` and `Reader::is_embedded` ([#1150](https://github.com/contentauth/c2pa-rs/pull/1150)) * Store icon references into c2pa.icon assertions for v2 instead of using data_boxes. ([#1235](https://github.com/contentauth/c2pa-rs/pull/1235)) * Remove file type from thumbnail names ([#1187](https://github.com/contentauth/c2pa-rs/pull/1187)) * Update MSRV to 1.85 ([#1208](https://github.com/contentauth/c2pa-rs/pull/1208)) ### Documented * Fix spec link for EmbeddedData ([#1226](https://github.com/contentauth/c2pa-rs/pull/1226)) * API doc clean up and improvement ([#1178](https://github.com/contentauth/c2pa-rs/pull/1178)) * Fix formatting of top level example. ([#1161](https://github.com/contentauth/c2pa-rs/pull/1161)) ### Fixed * Panic when adding empty actions assertion ([#1227](https://github.com/contentauth/c2pa-rs/pull/1227)) * Generated JPEG thumbnail incorrectly rotated ([#1233](https://github.com/contentauth/c2pa-rs/pull/1233)) * Unfreeze dependency on base64ct crate now that we're up to MSRV 1.85 ([#1228](https://github.com/contentauth/c2pa-rs/pull/1228)) * Clean up logs ([#1181](https://github.com/contentauth/c2pa-rs/pull/1181)) * Change timestamp validation to return new required info fields ([#1191](https://github.com/contentauth/c2pa-rs/pull/1191)) * Xmp jpeg write ([#1156](https://github.com/contentauth/c2pa-rs/pull/1156)) * Clippy warnings for Rust 1.88 ([#1204](https://github.com/contentauth/c2pa-rs/pull/1204)) ### Other * Move uri_to_path into utils ([#1186](https://github.com/contentauth/c2pa-rs/pull/1186)) ## [0.57.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.56.2...c2pa-v0.57.0) _19 June 2025_ ### Fixed * No-op change to trigger c2pa core crate publish ## [0.56.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.56.1...c2pa-v0.56.2) _18 June 2025_ ### Fixed * No-op change to trigger rebuild ## [0.56.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.56.0...c2pa-v0.56.1) _18 June 2025_ ### Fixed * To_archive does not store resources associated with ingredients ([#1151](https://github.com/contentauth/c2pa-rs/pull/1151)) ## [0.56.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.55.0...c2pa-v0.56.0) _17 June 2025_ ### Added * *(sdk)* Introduces get_supported_types api ([#1138](https://github.com/contentauth/c2pa-rs/pull/1138)) * Update Validation for 2.2 spec compliance ([#1144](https://github.com/contentauth/c2pa-rs/pull/1144)) ### Documented * Doc cleanup ([#1143](https://github.com/contentauth/c2pa-rs/pull/1143)) ### Fixed * Freeze base64ct crate at 1.7.3 for now ([#1163](https://github.com/contentauth/c2pa-rs/pull/1163)) * C2patool reports cawg.ica.credential_valid for valid CAWG X.509 signature (CAI-8751) ([#1155](https://github.com/contentauth/c2pa-rs/pull/1155)) * Docs.rs build using openssl and rust_native_crypto simulatenously ([#1139](https://github.com/contentauth/c2pa-rs/pull/1139)) ## [0.55.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.54.0...c2pa-v0.55.0) _27 May 2025_ ### Added * Es512 support without new dependencies ([#1130](https://github.com/contentauth/c2pa-rs/pull/1130)) ## [0.54.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.53.0...c2pa-v0.54.0) _27 May 2025_ ### Added * Make OpenSSL a default feature ([#1118](https://github.com/contentauth/c2pa-rs/pull/1118)) ### Fixed * Add CAWG support for fragmented BMFF ([#1114](https://github.com/contentauth/c2pa-rs/pull/1114)) ### Other * Integrates prebuilt library release workflow ([#1126](https://github.com/contentauth/c2pa-rs/pull/1126)) ## [0.53.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.52.0...c2pa-v0.53.0) _20 May 2025_ ### Added * [**breaking**] Merge `c2pa-status-tracker` crate into `c2pa` ([#1115](https://github.com/contentauth/c2pa-rs/pull/1115)) ### Fixed * Avoid yanked version of `windows-core` crate ([#1116](https://github.com/contentauth/c2pa-rs/pull/1116)) ## [0.52.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.51.1...c2pa-v0.52.0) _16 May 2025_ ### Added * [**breaking**] Merge c2pa-crypto crate into core c2pa crate ([#1099](https://github.com/contentauth/c2pa-rs/pull/1099)) ## [0.51.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.51.0...c2pa-v0.51.1) _16 May 2025_ ### Fixed * Switch zip dependency to a non-yanked version ([#1101](https://github.com/contentauth/c2pa-rs/pull/1101)) * Fix Clippy warnings for Rust 1.87 ([#1103](https://github.com/contentauth/c2pa-rs/pull/1103)) ## [0.51.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.50.0...c2pa-v0.51.0) _14 May 2025_ ### Added * [**breaking**] Merge CAWG identity SDK into main C2PA crate ([#1089](https://github.com/contentauth/c2pa-rs/pull/1089)) ### Fixed * Trigger re-publish of c2pa crate ## [0.50.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.5...c2pa-v0.50.0) _14 May 2025_ ### Added * Adds c_api for dynamic library releases ([#1047](https://github.com/contentauth/c2pa-rs/pull/1047)) * SVG thumbnails with a fix to the ingredient thumbnail format detection ([#722](https://github.com/contentauth/c2pa-rs/pull/722)) * *(sdk)* Support setting the Ingredient manifest_data field for remote manifests using Builder ([#1091](https://github.com/contentauth/c2pa-rs/pull/1091)) ### Fixed * Ingredient from_stream/memory not loading remote manifests ([#1061](https://github.com/contentauth/c2pa-rs/pull/1061)) ## [0.49.5](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.4...c2pa-v0.49.5) _25 April 2025_ ### Fixed * Return an error if a manifest cannot be read ([#1051](https://github.com/contentauth/c2pa-rs/pull/1051)) ## [0.49.4](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.3...c2pa-v0.49.4) _24 April 2025_ ### Fixed * Fix missing Action fields ([#1050](https://github.com/contentauth/c2pa-rs/pull/1050)) ## [0.49.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.2...c2pa-v0.49.3) _16 April 2025_ ### Fixed * Dynamic assertions should be gathered assertions ([#1005](https://github.com/contentauth/c2pa-rs/pull/1005)) ## [0.49.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.1...c2pa-v0.49.2) _07 April 2025_ ### Fixed * Populates claim signature field in ingredient v3. ([#1027](https://github.com/contentauth/c2pa-rs/pull/1027)) * Adjust dependencies to avoid security warnings and yanked versions ([#1031](https://github.com/contentauth/c2pa-rs/pull/1031)) * Enable trust checks for all unit tests ([#1022](https://github.com/contentauth/c2pa-rs/pull/1022)) ## [0.49.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.49.0...c2pa-v0.49.1) _04 April 2025_ ### Fixed * Update openssl to address a recently-announced vulnerability ([#1024](https://github.com/contentauth/c2pa-rs/pull/1024)) ## [0.49.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.48.2...c2pa-v0.49.0) _03 April 2025_ ### Added * *(cawg_identity)* Add `BuiltInSignatureVerifier` ([#978](https://github.com/contentauth/c2pa-rs/pull/978)) ### Fixed * Thread safe version of settings.rs ([#1018](https://github.com/contentauth/c2pa-rs/pull/1018)) * Fix support for user supplied labels ([#1017](https://github.com/contentauth/c2pa-rs/pull/1017)) * Sig check fix ([#1016](https://github.com/contentauth/c2pa-rs/pull/1016)) ## [0.48.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.48.1...c2pa-v0.48.2) _26 March 2025_ ### Fixed * Make sure manifests are signed with end-entity certs ([#997](https://github.com/contentauth/c2pa-rs/pull/997)) ### Other * Revert "chore: publish c2patool and cawg_identity updates ([#992](https://github.com/contentauth/c2pa-rs/pull/992))" ## [0.48.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.48.0...c2pa-v0.48.1) _20 March 2025_ ### Fixed * *(c2patool)* Fixes crash and improves cawg support (#989) ## [0.48.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.47.0...c2pa-v0.48.0) _19 March 2025_ ### Added * Adds allActionsIncluded flag to Actions Assertion (#986) ### Fixed * Generate gathered assertions for v2 claims (#985) ## [0.47.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.46.0...c2pa-v0.47.0) _18 March 2025_ ### Added * Adds `reader.post_validate` method for CAWG validation support (#976) * Add `StatusTracker` to `IdentityAssertion` parsing and validation APIs (#943) * Add `Sync` to `AsyncDynamicAssertion` (#953) * Simplify `StatusTracker` interface (#937) * Add WASI to c2patool (#945) * Add WASI support to cawg_identity (#942) * Add ES256 and ES384 Rust native signing (#941) * Adds validation_state to the json reports from the Reader (#930) * Wasm32 wasi 0.41.0 (#888) ### Fixed * Remove circular dependency between C2PA and CAWG crates (#982) * ISSUE-967: Remove the `RST0..=RST7` check from the `has_length` method for the JPEG asset handler. (#968) * Fix broken c2patool fragment feature (#960) * Feature flag `v1_api` without `file_io` didn't compile (#944) * Use older version of x509-certificate for wasm32-unknown (#934) * Fix new Clippy warnings for Rust 1.85.0 (#933) ### Other * Remove `openssl` feature flag (#940) ### Updated dependencies * Bump zip crate to 2.4.1 (#981) * Bump x509-certificate to 0.24.0 (#957) ## [0.46.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.3...c2pa-v0.46.0) _15 February 2025_ ### Added * Add support for DynamicAssertions in JSON format (#924) ### Fixed * Panic in decoding of GIF chunks (#873) * Use correct byte label for GIF Plain Text Extension (#864) * Panic in slicing of empty XMP data (#872) ### Other * Use `AsRef` in `jumbf_io` functions (#910) ## [0.45.3](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.2...c2pa-v0.45.3) _11 February 2025_ ### Fixed * Restore support for claim_generator_hints (#915) ## [0.45.2](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.1...c2pa-v0.45.2) _06 February 2025_ ### Documented * Fix reported errors for docs (#903) ### Fixed * Update error reporting (#906) * Repair cargo test (#898) ## [0.45.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.45.0...c2pa-v0.45.1) _31 January 2025_ ### Fixed * Remove dependency on SubtleCrypto (#881) ## [0.45.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.44.0...c2pa-v0.45.0) _30 January 2025_ ### Added * *(cawg_identity)* Split `CredentialHolder` into sync and async versions (#891) ## [0.44.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.43.0...c2pa-v0.44.0) _29 January 2025_ ### Added * Allow synchronous DynamicAssertion (#889) * Claim v2 (#707) ## [0.43.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.42.0...c2pa-v0.43.0) _24 January 2025_ ### Added * *(crypto)* Make `box_size` parameter on `c2pa_crypto::cose::sign` an `Option` (#879) ### Fixed * Bump coset requirement to 0.3.8 (#883) * Update id3 crate (#875) * Remove `Debug` supertrait from `DynamicAssertion` and `CredentialHolder` traits (#876) ## [0.42.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.41.1...c2pa-v0.42.0) _22 January 2025_ ### Added * Change the definition of `Signer.raw_signer()` to return an `Option` defaulting to `None` (#869) ## [0.41.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.41.0...c2pa-v0.41.1) _22 January 2025_ ### Fixed * Make alg enum exhaustive (#866) ## [0.41.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.40.0...c2pa-v0.41.0) _16 January 2025_ ### Added * *(crypto)* Add `rsa` crate support to `rust_native_crypto` feature (#853) * *(cawg_identity)* Implement identity assertion validation (#843) * Remove writing of native camera RAW formats from SDK (#814) * Review `c2pa-crypto` crate API (#813) * Add new function `c2pa_crypto::cose::signing_time_from_sign1` (#812) * Move COSE signing into `c2pa_crypto` crate (#807) * Move COSE timestamp generation into `c2pa_crypto` (#803) * Move COSE signature verification into `c2pa_crypto` (#801) * Introduce `c2pa_crypto::Verifier::verify_trust` (#798) * Introduce `c2pa_crypto::cose::Verifier` (#797) * Consolidate implementations of `cert_chain_from_sign1` in `c2pa_crypto` (#796) * Move `signing_alg_from_sign1` into `c2pa-crypto` (#795) * Move `get_cose_sign1` into `c2pa-crypto` crate (#794) * Move COSE OCSP support into c2pa-crypto (#793) * Move `verify_trust` into `c2pa_crypto` (#784) * Introduce `c2pa_crypto::CertificateAcceptancePolicy` (#779) * Bump MSRV to 1.81.0 (#781) ### Fixed * Make sure `DynamicAssertion::content` gets a properly populated `PartialClaim` (#842) * Switch to from fast_xml to quick_xml (#805) * Update img-parts for jpeg segment underflow fix (#806) * Bring `claim_v2` changes from #707 into `c2pa_crypto` (#811) * Improve usage of `#[cfg]` directives (#783) * OOB read attempt in jpeg_io asset handler in get_cai_segments function (#719) * Prevent negative length value for SVG object locations (#766) * JPEG `write_cai` OOB insertion (#762) * Add support XMP in SVG (#771) * Possible overflow for TIFF (#760) * Resolve new Clippy issues (#776) ### Updated dependencies * Bump jfifdump from 0.5.1 to 0.6.0 (#785) * Bump serde-wasm-bindgen from 0.5.0 to 0.6.5 (#786) * Bump thiserror from 2.0.6 to 2.0.8 (#787) * Bump rasn from 0.18.0 to 0.22.0 (#727) * Bump thiserror from 1.0.69 to 2.0.6 (#770) ## [0.40.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.39.0...c2pa-v0.40.0) _12 December 2024_ ### Added * Add `RawSigner` trait to `c2pa-crypto` (derived from `c2pa::Signer`) (#716) * Move time stamp code into c2pa-crypto (#696) * Adds ValidationState support (#701) * Introduce `DynamicAssertion` trait (#566) ### Fixed * Compile `c2pa-crypto` with `cargo check` (#768) * Verbose assertions for `is_none()` (#704) * Remove `c2pa::Signer` dependency on `c2pa_crypto::TimeStampProvider` (#718) * Add support for MP3 without ID3 header (#652) * Treat Unicode-3.0 license as approved; unpin related dependencies (#693) * Remote manifest fetch test was not using full path (#675) * Fix #624 (edge cases when combining the box hashes) (#625) * Fix #672, Callback is unsound (#674) * Support "remote_manifest_fetch" verify setting (#667) ### Updated dependencies * Bump chrono from 0.4.38 to 0.4.39 (#763) * Bump asn1-rs from 0.5.2 to 0.6.2 (#724) * Bump mockall requirement from 0.11.2 to 0.13.1 in /sdk (#685) * Update zip requirement from 0.6.6 to 2.2.1 in /sdk (#698) ## [0.39.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.38.0...c2pa-v0.39.0) _13 November 2024_ ### Added * Factor status tracking infrastructure into its own crate ([#665](https://github.com/contentauth/c2pa-rs/pull/665)) ### Fixed * Fixed a typo in ManifestDefinition docstring ([#639](https://github.com/contentauth/c2pa-rs/pull/639)) ## [0.38.0](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.37.1...c2pa-v0.38.0) _06 November 2024_ ### Added * Add fragmented mp4 Builder and Reader support ([#649](https://github.com/contentauth/c2pa-rs/pull/649)) * Associate ingredients with actions using parameters.org.cai.ingredientsIds array ([#627](https://github.com/contentauth/c2pa-rs/pull/627)) ### Fixed * Stay on url version 2.5.2 until Unicode-3.0 license can be approved ([#654](https://github.com/contentauth/c2pa-rs/pull/654)) ## [0.37.1](https://github.com/contentauth/c2pa-rs/compare/c2pa-v0.37.0...c2pa-v0.37.1) _24 October 2024_ ### Documented * Update API documentation ([#621](https://github.com/contentauth/c2pa-rs/pull/621)) ## [0.37.0](https://github.com/contentauth/c2pa-rs/compare/v0.36.4...v0.37.0) _17 October 2024_ ### Fixed * Adds identified RangeType to region of interest ([#631](https://github.com/contentauth/c2pa-rs/pull/631)) ## [0.36.4](https://github.com/contentauth/c2pa-rs/compare/v0.36.3...v0.36.4) _15 October 2024_ ### Fixed * Harden SDK against attempting buffers that are too large ([#628](https://github.com/contentauth/c2pa-rs/pull/628)) ## [0.36.3](https://github.com/contentauth/c2pa-rs/compare/v0.36.2...v0.36.3) _07 October 2024_ ### Fixed * Changelog contained duplicate entries for 0.16.1 ([#618](https://github.com/contentauth/c2pa-rs/pull/618)) ## [0.36.2](https://github.com/contentauth/c2pa-rs/compare/v0.36.1...v0.36.2) _07 October 2024_ * No-op change to start using release-plz to manage releases ## 0.36.1 _04 October 2024_ * fix: Make sure algorithm is being respected in data_hash.rs ([#613](https://github.com/contentauth/c2pa-rs/pull/613)) * fix: Make sure RSTn segment names are included in the data box hashes list ([#612](https://github.com/contentauth/c2pa-rs/pull/612)) * Update mp4 requirement from 0.13.0 to 0.14.0 in /sdk ([#595](https://github.com/contentauth/c2pa-rs/pull/595)) * chore: Add m4a test ([#606](https://github.com/contentauth/c2pa-rs/pull/606)) * fix: Write absolute urls to manifest store resource references. ([#603](https://github.com/contentauth/c2pa-rs/pull/603)) * doc: Removes xmp_write feature from README.md. * chore: Remove deprecated actions-rs/clippy-check action ([#601](https://github.com/contentauth/c2pa-rs/pull/601)) * chore: bump stefanzweifel/git-auto-commit-action from 4 to 5 ([#600](https://github.com/contentauth/c2pa-rs/pull/600)) * chore: bump actions/github-script from 3 to 7 ([#599](https://github.com/contentauth/c2pa-rs/pull/599)) * chore: bump paulhatch/semantic-version from 5.2.1 to 5.4.0 ([#598](https://github.com/contentauth/c2pa-rs/pull/598)) * chore: Use Dependabot to upgrade GitHub Actions steps ([#597](https://github.com/contentauth/c2pa-rs/pull/597)) * chore: Fix dependabot issues ([#594](https://github.com/contentauth/c2pa-rs/pull/594)) * Fixes issue where nested assertion-uri-hash errors were being reported at the active manifest level. ([#593](https://github.com/contentauth/c2pa-rs/pull/593)) * Feature/add content length to tsa request ([#587](https://github.com/contentauth/c2pa-rs/pull/587)) ## 0.36.0 _23 September 2024_ * (MINOR) ensures release bumps minor version ([#592](https://github.com/contentauth/c2pa-rs/pull/592)) * fix: requires "StatusTracker" to implement "Send" ([#589](https://github.com/contentauth/c2pa-rs/pull/589)) ## 0.35.1 _17 September 2024_ * Fix error when trying to sign BMFF content with Builder. ([#582](https://github.com/contentauth/c2pa-rs/pull/582)) ## 0.35.0 _12 September 2024_ * upgrades to riff@2.0.0, preventing panic on invalid riff files ([#579](https://github.com/contentauth/c2pa-rs/pull/579)) * EC signature DER support ([#581](https://github.com/contentauth/c2pa-rs/pull/581)) * Update base64 requirement from 0.21.2 to 0.22.1 in /sdk ([#519](https://github.com/contentauth/c2pa-rs/pull/519)) * (MINOR) Rust API enhancements and fixes. ([#575](https://github.com/contentauth/c2pa-rs/pull/575)) * Fix GIF off by one with XMP ([#562](https://github.com/contentauth/c2pa-rs/pull/562)) ## 0.34.0 _30 August 2024_ * (MINOR) Fragmented BMFF media ([#572](https://github.com/contentauth/c2pa-rs/pull/572)) ## 0.33.4 _29 August 2024_ * Depend on url crate version 2.5.2 or newer ([#573](https://github.com/contentauth/c2pa-rs/pull/573)) ## 0.33.3 _17 August 2024_ * Inline certs for wasm test signer ([#564](https://github.com/contentauth/c2pa-rs/pull/564)) ## 0.33.2 _15 August 2024_ * Bmff write fix ([#552](https://github.com/contentauth/c2pa-rs/pull/552)) * Fix remote embedding RIFF when specifying mime type ([#551](https://github.com/contentauth/c2pa-rs/pull/551)) * Fix data hash out of bounds when using placeholder beyond stream length ([#546](https://github.com/contentauth/c2pa-rs/pull/546)) * Adds embeddable apis and remote_url/no_embed options ([#537](https://github.com/contentauth/c2pa-rs/pull/537)) * export_schema: add unstable_api feature ([#542](https://github.com/contentauth/c2pa-rs/pull/542)) * Ingredient checks ([#529](https://github.com/contentauth/c2pa-rs/pull/529)) * Add base_path field to Builder ([#539](https://github.com/contentauth/c2pa-rs/pull/539)) * Export `AssertionDefinition` and `ActionTemplate` in public API ([#522](https://github.com/contentauth/c2pa-rs/pull/522)) ## 0.33.1 _30 July 2024_ * Use timestamp with OpenSSL validation to prevent check chain check er… ([#531](https://github.com/contentauth/c2pa-rs/pull/531)) * Fix GIF `remove_cai_store_from_stream` behavior ([#524](https://github.com/contentauth/c2pa-rs/pull/524)) ## 0.33.0 _26 July 2024_ * Update crate to fix bad certificate dump content ([#525](https://github.com/contentauth/c2pa-rs/pull/525)) * Introduce a mutex around the FFI calls to OpenSSL ([#516](https://github.com/contentauth/c2pa-rs/pull/516)) * Bump bcder minimum version to 0.7.3 ([#526](https://github.com/contentauth/c2pa-rs/pull/526)) * (MINOR) Updates needed for v2 JavaScript SDK ([#521](https://github.com/contentauth/c2pa-rs/pull/521)) * Add region of interest assertion definition ([#506](https://github.com/contentauth/c2pa-rs/pull/506)) * Fix CI tests ([#520](https://github.com/contentauth/c2pa-rs/pull/520)) * Builder Archive update ([#507](https://github.com/contentauth/c2pa-rs/pull/507)) * Update range-set requirement from 0.0.9 to 0.0.11 in /sdk ([#442](https://github.com/contentauth/c2pa-rs/pull/442)) * Make sure reading past end of JUMBF box is an error ([#518](https://github.com/contentauth/c2pa-rs/pull/518)) * added final details ([#517](https://github.com/contentauth/c2pa-rs/pull/517)) ## 0.32.7 _18 July 2024_ * Ensure Ingredient data_types make it to the store and back. ([#514](https://github.com/contentauth/c2pa-rs/pull/514)) * draft security md ([#508](https://github.com/contentauth/c2pa-rs/pull/508)) * Make data_types field optional when serializing data-box-map ([#512](https://github.com/contentauth/c2pa-rs/pull/512)) * Fix box hash placeholder len (set to 1) ([#511](https://github.com/contentauth/c2pa-rs/pull/511)) * Set data box placeholder len to at least 1 for GIF ([#510](https://github.com/contentauth/c2pa-rs/pull/510)) * Rewind mp3 streams when reading/writing ([#509](https://github.com/contentauth/c2pa-rs/pull/509)) * Update README.md ([#351](https://github.com/contentauth/c2pa-rs/pull/351)) * Add GIF support ([#489](https://github.com/contentauth/c2pa-rs/pull/489)) * Update image requirement from 0.24.7 to 0.25.1 in /make_test_images ([#445](https://github.com/contentauth/c2pa-rs/pull/445)) * Upgrade uuid to 1.7.0 & fix removed wasm-bindgen feature ([#450](https://github.com/contentauth/c2pa-rs/pull/450)) * Expose `SignatureInfo` publicly ([#501](https://github.com/contentauth/c2pa-rs/pull/501)) * Cleanup empty/unused files + lints ([#500](https://github.com/contentauth/c2pa-rs/pull/500)) ## 0.32.6 _15 July 2024_ * Fetching of databoxes must always use HashedURI to enforce hash checks. ([#505](https://github.com/contentauth/c2pa-rs/pull/505)) * Temporarily allow unused `JsonAssertionData` to fix unused error in CI ([#498](https://github.com/contentauth/c2pa-rs/pull/498)) * Add remote manifest support to MP3 ([#496](https://github.com/contentauth/c2pa-rs/pull/496)) ## 0.32.5 _28 June 2024_ * (PATCH) ensures temp files are removed ([#494](https://github.com/contentauth/c2pa-rs/pull/494)) * Update async_generic to 1.1 ([#493](https://github.com/contentauth/c2pa-rs/pull/493)) ## 0.32.4 _25 June 2024_ * Add data_type (future) to Ingredient_V2 ([#490](https://github.com/contentauth/c2pa-rs/pull/490)) * Let's not assume that third-party assertions are using serde_cbor ([#491](https://github.com/contentauth/c2pa-rs/pull/491)) ## 0.32.3 _24 June 2024_ * External placed manifest ([#472](https://github.com/contentauth/c2pa-rs/pull/472)) * Support metadata field in claims. ([#488](https://github.com/contentauth/c2pa-rs/pull/488)) ## 0.32.2 _19 June 2024_ * Add iterators over manifests and resources in unstable API ([#482](https://github.com/contentauth/c2pa-rs/pull/482)) * OCSP certificate should be valid at signing time ([#481](https://github.com/contentauth/c2pa-rs/pull/481)) * url crate version 2.5.1 introduces new license "Unicode-3.0" ([#483](https://github.com/contentauth/c2pa-rs/pull/483)) * Implement `Debug` w/ detailed manifest for `Reader` ([#473](https://github.com/contentauth/c2pa-rs/pull/473)) * Bump MSRV to 1.74 ([#478](https://github.com/contentauth/c2pa-rs/pull/478)) * Allow empty Merkle proof for last leaf node. ([#470](https://github.com/contentauth/c2pa-rs/pull/470)) ## 0.32.1 _10 May 2024_ * Steps toward removing RemoteSigner APIs. ([#466](https://github.com/contentauth/c2pa-rs/pull/466)) ## 0.32.0 _07 May 2024_ * (Minor) Additional unit tests and fixes for injection (or previously untested) issues. ([#464](https://github.com/contentauth/c2pa-rs/pull/464)) * Expose authoring support in WASM ([#369](https://github.com/contentauth/c2pa-rs/pull/369)) * Move signer to first parameter on Builder.sign ([#457](https://github.com/contentauth/c2pa-rs/pull/457)) * Gpeacock/embed_remote_settings ([#460](https://github.com/contentauth/c2pa-rs/pull/460)) * (MINOR) Removes xmp_write feature and xmp_toolkit ([#461](https://github.com/contentauth/c2pa-rs/pull/461)) * Async Signer: add support for async OCSP call ([#458](https://github.com/contentauth/c2pa-rs/pull/458)) * Use cargo test in CI ([#459](https://github.com/contentauth/c2pa-rs/pull/459)) * (MINOR) Initial V2 API work ([#437](https://github.com/contentauth/c2pa-rs/pull/437)) ## 0.31.3 _05 April 2024_ * Add `video/quicktime` to the list of BMFF MIME types ([#441](https://github.com/contentauth/c2pa-rs/pull/441)) * Streaming XMP write support for PNG ([#439](https://github.com/contentauth/c2pa-rs/pull/439)) ## 0.31.2 _03 April 2024_ * Fixed temp file auto delete ([#438](https://github.com/contentauth/c2pa-rs/pull/438)) * Add `Sync` trait to `TrustHandlerConfig` ([#440](https://github.com/contentauth/c2pa-rs/pull/440)) * remove file_io dependency on fetch_remote_manifests ([#434](https://github.com/contentauth/c2pa-rs/pull/434)) * Remove verify after signing when compiling without openssl ([#404](https://github.com/contentauth/c2pa-rs/pull/404)) * Streaming write support for BMFF ([#435](https://github.com/contentauth/c2pa-rs/pull/435)) * Added support for XMP streaming writes for TIFF/DNG ([#433](https://github.com/contentauth/c2pa-rs/pull/433)) * Implements embed_reference_to_stream for jpeg ([#430](https://github.com/contentauth/c2pa-rs/pull/430)) ## 0.31.1 _25 March 2024_ * Adds Action changes field as option vec of serde_json value ([#431](https://github.com/contentauth/c2pa-rs/pull/431)) ## 0.31.0 _13 March 2024_ * (MINOR) Adds Send trait to TrustHandlerConfig ([#426](https://github.com/contentauth/c2pa-rs/pull/426)) ## 0.30.3 _12 March 2024_ * Roll back rasn-* version requirements since 0.12.6 was yanked ([#425](https://github.com/contentauth/c2pa-rs/pull/425)) ## 0.30.2 _12 March 2024_ * Adds a Manifest::composed manifest method ([#424](https://github.com/contentauth/c2pa-rs/pull/424)) * Allow cert dump to work in WASM ([#420](https://github.com/contentauth/c2pa-rs/pull/420)) * Update minimum dependency of rasn-* crates ([#423](https://github.com/contentauth/c2pa-rs/pull/423)) ## 0.30.1 _08 March 2024_ * Fix include_byte references that were not available in external crate builds ## 0.30.0 _08 March 2024_ * (MINOR) Remove testing function that was inadvertently public ([#421](https://github.com/contentauth/c2pa-rs/pull/421)) ## 0.29.3 _08 March 2024_ * Trust support ([#415](https://github.com/contentauth/c2pa-rs/pull/415)) ## 0.29.2 _08 March 2024_ * add a thumb resource when referencing an embedded uri ([#419](https://github.com/contentauth/c2pa-rs/pull/419)) ## 0.29.1 _07 March 2024_ * Adds Manifest.remote_manifest_url() (CAI-5437) ([#418](https://github.com/contentauth/c2pa-rs/pull/418)) * Fix use of deprecated method `chrono::NaiveDateTime::timestamp` ([#417](https://github.com/contentauth/c2pa-rs/pull/417)) * Fix up some random typos. ([#353](https://github.com/contentauth/c2pa-rs/pull/353)) ## 0.29.0 _26 February 2024_ * SDK configuration settings support (infrastructure) ([#408](https://github.com/contentauth/c2pa-rs/pull/408)) * Support streaming writes for TIFF ([#410](https://github.com/contentauth/c2pa-rs/pull/410)) * Fixed typo in comment ([#409](https://github.com/contentauth/c2pa-rs/pull/409)) * (MINOR) Update `xmp_toolkit` to v1.7.1, remove Ring dependency, fix build errors ([#407](https://github.com/contentauth/c2pa-rs/pull/407)) * Crate udate to fix jpeg parsing error ([#402](https://github.com/contentauth/c2pa-rs/pull/402)) * allows builds to pass ([#403](https://github.com/contentauth/c2pa-rs/pull/403)) * Ocsp support ([#371](https://github.com/contentauth/c2pa-rs/pull/371)) ## 0.28.5 _06 February 2024_ * Finish async signing implementation for cose_sign ([#370](https://github.com/contentauth/c2pa-rs/pull/370)) * adds read_cai test for PDF with content credentials ([#366](https://github.com/contentauth/c2pa-rs/pull/366)) * [IGNORE] README edits ([#356](https://github.com/contentauth/c2pa-rs/pull/356)) * Update ci.yml * Remove deprecated twoway crate ([#361](https://github.com/contentauth/c2pa-rs/pull/361)) * Fix response strings for BMFF and Box hash statuses ([#360](https://github.com/contentauth/c2pa-rs/pull/360)) * Restore correct 1.3 CoseSign1 headers ([#359](https://github.com/contentauth/c2pa-rs/pull/359)) * Openssl update to version 3.x ([#357](https://github.com/contentauth/c2pa-rs/pull/357)) * Add support for ARW and NEF ([#355](https://github.com/contentauth/c2pa-rs/pull/355)) ## 0.28.4 _04 December 2023_ * CAI-5041 Clear Windows temp attribute ([#352](https://github.com/contentauth/c2pa-rs/pull/352)) ## 0.28.3 _22 November 2023_ * Remove Blake3 dependency from c2pa-rs ([#348](https://github.com/contentauth/c2pa-rs/pull/348)) ## 0.28.2 _21 November 2023_ * Fix PDF reading of manifest from wrong key ([#346](https://github.com/contentauth/c2pa-rs/pull/346)) ## 0.28.1 _17 November 2023_ * readme update ([#345](https://github.com/contentauth/c2pa-rs/pull/345)) * Add support for embeddable manifests with RemoteSigner ([#344](https://github.com/contentauth/c2pa-rs/pull/344)) * Blake build fix ([#343](https://github.com/contentauth/c2pa-rs/pull/343)) * Update image crate dependency and limit features ([#341](https://github.com/contentauth/c2pa-rs/pull/341)) * Bump xmp_toolkit requirement to 1.6 ([#339](https://github.com/contentauth/c2pa-rs/pull/339)) * Disable Windows builds with latest Rust version ([#342](https://github.com/contentauth/c2pa-rs/pull/342)) ## 0.28.0 _01 November 2023_ * (PATCH) switches af relationship for a reference to the c2pa data to an array of references, one of which is the c2pa spec ([#333](https://github.com/contentauth/c2pa-rs/pull/333)) * Restore async versions of embed functions ([#327](https://github.com/contentauth/c2pa-rs/pull/327)) * (MINOR) Support databox thumbnails CAI-4142 ([#325](https://github.com/contentauth/c2pa-rs/pull/325)) * (MINOR) Reuse claim thumbnail as ingredient thumbnail if the store is valid ([#322](https://github.com/contentauth/c2pa-rs/pull/322)) * (MINOR) Use JUMBF URIs for ManifestStore identifiers ([#323](https://github.com/contentauth/c2pa-rs/pull/323)) * Add ManifestStore::from_stream ([#319](https://github.com/contentauth/c2pa-rs/pull/319)) * Adds embed_to_stream ([#313](https://github.com/contentauth/c2pa-rs/pull/313)) ## 0.27.1 _04 October 2023_ * Support for validating JPEGs that contain MPF (multi-picture format). ([#317](https://github.com/contentauth/c2pa-rs/pull/317)) * Add ability to customize HTTP headers on timestamp request to Signer and AsyncSigner traits ([#315](https://github.com/contentauth/c2pa-rs/pull/315)) * Add all of the MIME types that are associated with WAV files ([#316](https://github.com/contentauth/c2pa-rs/pull/316)) * Allow MS_C2PA_SIGNING OID to pass ([#314](https://github.com/contentauth/c2pa-rs/pull/314)) ## 0.27.0 _29 September 2023_ * supports removal of manifests from pdf ([#312](https://github.com/contentauth/c2pa-rs/pull/312)) * Support for MP3 ([#295](https://github.com/contentauth/c2pa-rs/pull/295)) * (MINOR) Signer can call timestamp authority directly ([#311](https://github.com/contentauth/c2pa-rs/pull/311)) * implements pdf read support ([#309](https://github.com/contentauth/c2pa-rs/pull/309)) ## 0.26.0 _13 September 2023_ * Add support for default SVG MIME type ([#305](https://github.com/contentauth/c2pa-rs/pull/305)) * Support for writing and reading manifest data from simple PDFs (without incremental updates or signatures) ([#249](https://github.com/contentauth/c2pa-rs/pull/249)) * Increase actix requirement to 0.13.1 ([#304](https://github.com/contentauth/c2pa-rs/pull/304)) * (MINOR) Expose HashRange ([#300](https://github.com/contentauth/c2pa-rs/pull/300)) * Lock openssl-sys version to 0.9.92 ([#302](https://github.com/contentauth/c2pa-rs/pull/302)) * Update links to C2PA spec to 1.3 ([#292](https://github.com/contentauth/c2pa-rs/pull/292)) * Error saving stream writes ([#290](https://github.com/contentauth/c2pa-rs/pull/290)) * Fix for overly harsh checks when checking Merkle trees. ([#289](https://github.com/contentauth/c2pa-rs/pull/289)) ## 0.25.2 _02 August 2023_ * Adds a way to force no claim thumbnail generation ([#288](https://github.com/contentauth/c2pa-rs/pull/288)) * adds ManifestStoreReport::cert_chain_from_bytes ([#286](https://github.com/contentauth/c2pa-rs/pull/286)) ## 0.25.1 _14 July 2023_ * Expose DataHash and BoxHash to public SDK ([#284](https://github.com/contentauth/c2pa-rs/pull/284)) * Remove debug statement ([#283](https://github.com/contentauth/c2pa-rs/pull/283)) ## 0.25.0 _14 July 2023_ * (MINOR) User, UserCbor and Uuid assertions removed from SDK ([#141](https://github.com/contentauth/c2pa-rs/pull/141)) * Fix for #195 make_test_images missing ingredient references ([#254](https://github.com/contentauth/c2pa-rs/pull/254)) * Return ResourceNotFound instead of NotFound for resource get ([#279](https://github.com/contentauth/c2pa-rs/pull/279)) * (MINOR) Minor improvements for Wasm and Node.js interoperability ([#276](https://github.com/contentauth/c2pa-rs/pull/276)) * Fix iloc extent_offsets when offset_size is 0 ([#277](https://github.com/contentauth/c2pa-rs/pull/277)) * (MINOR) Converts DataHash and BoxHash methods to use RemoteSigner instead of AsyncSigner ([#280](https://github.com/contentauth/c2pa-rs/pull/280)) * (MINOR) Embeddable manifest support ([#266](https://github.com/contentauth/c2pa-rs/pull/266)) * Repair CI tests ([#278](https://github.com/contentauth/c2pa-rs/pull/278)) ## 0.24.0 _21 June 2023_ * (MINOR) force minor version change ([#273](https://github.com/contentauth/c2pa-rs/pull/273)) ## 0.23.3 _21 June 2023_ * Bump minor version and update README.md ([#272](https://github.com/contentauth/c2pa-rs/pull/272)) * Updates ([#270](https://github.com/contentauth/c2pa-rs/pull/270)) * Add `Send` to `CAIRead` trait so that it can be used across threads ([#271](https://github.com/contentauth/c2pa-rs/pull/271)) * Generate old COSE headers for temporary backwards support ([#269](https://github.com/contentauth/c2pa-rs/pull/269)) ## 0.23.2 _19 June 2023_ * Fix for returning input stream data when using `embed_from_memory` ([#268](https://github.com/contentauth/c2pa-rs/pull/268)) ## 0.23.1 _13 June 2023_ * Remove no-default ci test ([#259](https://github.com/contentauth/c2pa-rs/pull/259)) * includes the cert serial number in the ValidationInfo output ([#263](https://github.com/contentauth/c2pa-rs/pull/263)) * adds ManifestStoreReport::cert_chain ([#265](https://github.com/contentauth/c2pa-rs/pull/265)) * Update Timestamp message imprint to include entire protected header ([#264](https://github.com/contentauth/c2pa-rs/pull/264)) ## 0.23.0 _09 June 2023_ * Box hash support ([#261](https://github.com/contentauth/c2pa-rs/pull/261)) * Fix timestamp Accuracy decoding ([#262](https://github.com/contentauth/c2pa-rs/pull/262)) * Make remote manifest handling consistent across input types ([#260](https://github.com/contentauth/c2pa-rs/pull/260)) * (MINOR) Support for Ingredients V2 and Actions V2 ([#258](https://github.com/contentauth/c2pa-rs/pull/258)) * Generate and validate 1.3 Cose signatures ([#256](https://github.com/contentauth/c2pa-rs/pull/256)) * Add type exports via JSON Schema ([#255](https://github.com/contentauth/c2pa-rs/pull/255)) * Bmff v2 ([#251](https://github.com/contentauth/c2pa-rs/pull/251)) ## 0.22.0 _18 May 2023_ * (MINOR) Improved Remote Manifest handling ([#250](https://github.com/contentauth/c2pa-rs/pull/250)) * Riff streaming support ([#248](https://github.com/contentauth/c2pa-rs/pull/248)) ## 0.21.0 _04 May 2023_ * (MINOR) Added ResourceNotFound error ([#244](https://github.com/contentauth/c2pa-rs/pull/244)) ## 0.20.3 _03 May 2023_ * backed out calls to set_memory_thumbnail ([#243](https://github.com/contentauth/c2pa-rs/pull/243)) * Revert "backed out calls to set_memory_thumbnail" * backed out calls to set_memory_thumbnail This was causing thumbnail files to not be generated. ## 0.20.2 _24 April 2023_ * Fixes bug in Ingredient_from_stream_info ([#241](https://github.com/contentauth/c2pa-rs/pull/241)) ## 0.20.1 _20 April 2023_ * Ingredient async and thumbnail support ([#240](https://github.com/contentauth/c2pa-rs/pull/240)) * Update actix requirement from 0.11.0 to 0.13.0 in /sdk ([#209](https://github.com/contentauth/c2pa-rs/pull/209)) * Update uuid requirement from 0.8.1 to 1.3.1 in /sdk ([#237](https://github.com/contentauth/c2pa-rs/pull/237)) * Upgrade x509-parser to 0.15.0 ([#229](https://github.com/contentauth/c2pa-rs/pull/229)) * Add support for ARM on Linux ([#233](https://github.com/contentauth/c2pa-rs/pull/233)) ## 0.20.0 _05 April 2023_ * (MINOR) SVG support ([#226](https://github.com/contentauth/c2pa-rs/pull/226)) * (MINOR) Update several X509-related crate dependencies ([#225](https://github.com/contentauth/c2pa-rs/pull/225)) * Update thiserror to 1.0.40 in /sdk ([#223](https://github.com/contentauth/c2pa-rs/pull/223)) * Avoid chrono's transitive dependency on time crate ([#222](https://github.com/contentauth/c2pa-rs/pull/222)) * Require openssl >0.10.48 to address multiple RUSTSEC warnings ([#221](https://github.com/contentauth/c2pa-rs/pull/221)) * Apply code format to doc comments ([#220](https://github.com/contentauth/c2pa-rs/pull/220)) ## 0.19.1 _28 March 2023_ * Update README ([#215](https://github.com/contentauth/c2pa-rs/pull/215)) ## 0.19.0 _23 March 2023_ * Makefile update ([#213](https://github.com/contentauth/c2pa-rs/pull/213)) * Streaming enhancement ([#212](https://github.com/contentauth/c2pa-rs/pull/212)) * Adds base_path_take to ResourceStore ([#205](https://github.com/contentauth/c2pa-rs/pull/205)) * Add write support for HEIC, HEIF, AVIF ([#210](https://github.com/contentauth/c2pa-rs/pull/210)) * (MINOR) Riff support with refactored AssetIO ([#203](https://github.com/contentauth/c2pa-rs/pull/203)) * (MINOR) Resource format and is_parent / relationship changes ([#202](https://github.com/contentauth/c2pa-rs/pull/202)) * Fix hash algo warning in Wasm and hashing for RSA-PSS SHA-384/512 ([#206](https://github.com/contentauth/c2pa-rs/pull/206)) * Derive impl of Default for Relationship enum ([#204](https://github.com/contentauth/c2pa-rs/pull/204)) ## 0.18.1 _07 March 2023_ * Update Validation Status codes ([#200](https://github.com/contentauth/c2pa-rs/pull/200)) * Fix async path to support ingredient box hashing ([#201](https://github.com/contentauth/c2pa-rs/pull/201)) ## 0.18.0 _02 March 2023_ * Fix issue where value was inadvertently included in Exclusion structure ([#197](https://github.com/contentauth/c2pa-rs/pull/197)) * (MINOR) Bump MSRV to 1.63.0 ([#198](https://github.com/contentauth/c2pa-rs/pull/198)) * Fixed unit test failure (invalid unique name generation). ([#190](https://github.com/contentauth/c2pa-rs/pull/190)) ## 0.17.0 _22 February 2023_ * Disable mdat exclusion ([#187](https://github.com/contentauth/c2pa-rs/pull/187)) * Bmff v2 ([#186](https://github.com/contentauth/c2pa-rs/pull/186)) * Fix for using non-c2pa segment when add required segments ([#185](https://github.com/contentauth/c2pa-rs/pull/185)) * Update Ingredient and VC hashes to 1.2 spec ([#184](https://github.com/contentauth/c2pa-rs/pull/184)) * (MINOR) Create a ResourceStore for binary assets ([#180](https://github.com/contentauth/c2pa-rs/pull/180)) * Fix Clippy warnings from new Rust 1.67 ([#182](https://github.com/contentauth/c2pa-rs/pull/182)) * Visualizations ([#163](https://github.com/contentauth/c2pa-rs/pull/163)) ## 0.16.1 _19 December 2022_ * Update xmp-toolkit from 0.6.0 to 1.0.0 ([#165](https://github.com/contentauth/c2pa-rs/pull/165)) * Address new Clippy warnings for Rust 1.66 ([#164](https://github.com/contentauth/c2pa-rs/pull/164)) * Create external manifests for unknown types ([#162](https://github.com/contentauth/c2pa-rs/pull/162)) ## 0.16.0 _03 December 2022_ * Updates some cargo dependencies ([#159](https://github.com/contentauth/c2pa-rs/pull/159)) * makes manifest#add_redaction public; adds test ([#156](https://github.com/contentauth/c2pa-rs/pull/156)) * Fixes support for instanceId on action and generate parameters.ingredient field when possible ([#158](https://github.com/contentauth/c2pa-rs/pull/158)) * Support digitalSourceType field in Action ([#154](https://github.com/contentauth/c2pa-rs/pull/154)) * (MINOR) Add sign feature for signing manifests without file I/O ([#125](https://github.com/contentauth/c2pa-rs/pull/125)) * TIFF/DNG support ([#152](https://github.com/contentauth/c2pa-rs/pull/152)) ## 0.15.0 _09 November 2022_ * Fix bad error response when manifest is stripped ([#153](https://github.com/contentauth/c2pa-rs/pull/153)) * (MINOR) Bump MSRV to 1.61 ([#142](https://github.com/contentauth/c2pa-rs/pull/142)) * Fix new Clippy warnings generated by Rust 1.65 ([#151](https://github.com/contentauth/c2pa-rs/pull/151)) * Build infrastructure improvements ([#150](https://github.com/contentauth/c2pa-rs/pull/150)) * Fix manifest.set_thumbnail when add_thumbnails is enabled ([#148](https://github.com/contentauth/c2pa-rs/pull/148)) * Fix for XMP links being mistaken for remote URLs ([#147](https://github.com/contentauth/c2pa-rs/pull/147)) * Upgrade xmp_toolkit to 0.6.0 ([#146](https://github.com/contentauth/c2pa-rs/pull/146)) * create jpeg thumbnails for pngs without alpha ([#145](https://github.com/contentauth/c2pa-rs/pull/145)) * Add test_embed_with_ingredient_err ([#134](https://github.com/contentauth/c2pa-rs/pull/134)) ## 0.14.1 _04 October 2022_ * Add homepage and repository links to crates.io ([#132](https://github.com/contentauth/c2pa-rs/pull/132)) * Add Exif Assertion support ([#140](https://github.com/contentauth/c2pa-rs/pull/140)) ## 0.14.0 _23 September 2022_ * (MINOR) Remove previously embedded manifests for remote manifests ([#136](https://github.com/contentauth/c2pa-rs/pull/136)) * (MINOR) Add support for manifest removal ([#123](https://github.com/contentauth/c2pa-rs/pull/123)) ## 0.13.2 _21 September 2022_ * manifest_data was missing for remote manifests ([#135](https://github.com/contentauth/c2pa-rs/pull/135)) ## 0.13.1 _13 September 2022_ * Add ManifestStore::from_manifest_and_asset_bytes_async ([#130](https://github.com/contentauth/c2pa-rs/pull/130)) ## 0.13.0 _26 August 2022_ * Add RemoteManifestUrl Error, returning url ([#120](https://github.com/contentauth/c2pa-rs/pull/120)) * Convert status_log error val to a string so that we can return full errors ([#121](https://github.com/contentauth/c2pa-rs/pull/121)) * Report failures from remote manifest fetch ([#116](https://github.com/contentauth/c2pa-rs/pull/116)) * Fast XMP extraction from PNG ([#117](https://github.com/contentauth/c2pa-rs/pull/117)) * Bump MSRV to 1.59.0 ([#118](https://github.com/contentauth/c2pa-rs/pull/118)) * Make sure there is a single manifest store in the asset ([#114](https://github.com/contentauth/c2pa-rs/pull/114)) * (MINOR) Switch to "lib" for crate-type ([#113](https://github.com/contentauth/c2pa-rs/pull/113)) ## 0.12.0 _16 August 2022_ * Update C2PA manifest store mime type ([#112](https://github.com/contentauth/c2pa-rs/pull/112)) * Updates Manifest API to support remote and external manifests ([#107](https://github.com/contentauth/c2pa-rs/pull/107)) * Support validating remote and external manifest stores ([#108](https://github.com/contentauth/c2pa-rs/pull/108)) * Fix build error when xmp_write is not defined ([#105](https://github.com/contentauth/c2pa-rs/pull/105)) * Fix box order for BMFF ([#104](https://github.com/contentauth/c2pa-rs/pull/104)) * Added support for external manifests ([#101](https://github.com/contentauth/c2pa-rs/pull/101)) ## 0.11.3 _03 August 2022_ * Remove inadvertent 1.0.0 release from changelog ([#97](https://github.com/contentauth/c2pa-rs/pull/97)) * Treat 'meta' box as standard container ([#95](https://github.com/contentauth/c2pa-rs/pull/95)) * Fix for `sign_claim` masking error ([#96](https://github.com/contentauth/c2pa-rs/pull/96)) ## 0.11.1 _01 August 2022_ * Bug fix: Ingredients with valid claims not reporting correct thumbnails ([#94](https://github.com/contentauth/c2pa-rs/pull/94)) * Update `make_test_images` to use timestamp authority ([#90](https://github.com/contentauth/c2pa-rs/pull/90)) * Fix bad response for case when there is no timestamp ([#89](https://github.com/contentauth/c2pa-rs/pull/89)) ## 0.11.0 _21 July 2022_ * (MINOR) Add support for remotely generated CoseSign1 signatures ([#87](https://github.com/contentauth/c2pa-rs/pull/87)) * Optimize performance of large assets ([#84](https://github.com/contentauth/c2pa-rs/pull/84)) ## 0.10.0 _20 July 2022_ * Add Unicode license to allow-list ([#85](https://github.com/contentauth/c2pa-rs/pull/85)) * (MINOR) `IngredientOptions` allow override of hash and thumbnail generation; image library is now a default feature ([#79](https://github.com/contentauth/c2pa-rs/pull/79)) ## 0.9.1 _19 July 2022_ * Fix publish workflow ([#82](https://github.com/contentauth/c2pa-rs/pull/82)) ## 0.9.0 _19 July 2022_ * (MINOR) Introduce a new `SigningAlg` enum ([#76](https://github.com/contentauth/c2pa-rs/pull/76)) * Support for asynchronous signing of claims ([#57](https://github.com/contentauth/c2pa-rs/pull/57)) * Adds an add_validation_status method to Ingredient ([#68](https://github.com/contentauth/c2pa-rs/pull/68)) ## 0.8.1 _15 July 2022_ * Use rsa crate for RSA-PSS verification in Wasm ([#77](https://github.com/contentauth/c2pa-rs/pull/77)) ## 0.8.0 _15 July 2022_ * Add a new API to provide access to COSE signing logic for external signers ([#75](https://github.com/contentauth/c2pa-rs/pull/75)) * (MINOR) Move crate-level functions for creating signers to new public `create_signer` mod ([#72](https://github.com/contentauth/c2pa-rs/pull/72)) ## 0.7.2 _14 July 2022_ * Fix broken documentation build ([#74](https://github.com/contentauth/c2pa-rs/pull/74)) ## 0.7.1 _14 July 2022_ * Configure docs.rs to include feature-gated items ([#73](https://github.com/contentauth/c2pa-rs/pull/73)) * Update XMP Toolkit to 0.5.0 ([#71](https://github.com/contentauth/c2pa-rs/pull/71)) * Refactor code to limit memory usage and remove data copies during hash generation ([#67](https://github.com/contentauth/c2pa-rs/pull/67)) ## 0.7.0 _29 June 2022_ * (MINOR) Return specific errors for FileNotFound and UnsupportedType ([#62](https://github.com/contentauth/c2pa-rs/pull/62)) ## 0.6.1 _28 June 2022_ * Fix up changelog noise * Fix bug with multiple ingredients in `Manifest::from_store` ([#61](https://github.com/contentauth/c2pa-rs/pull/61)) ## 0.6.0 _28 June 2022_ * (MINOR) Initial BMFF support ([#39](https://github.com/contentauth/c2pa-rs/pull/39)) ## 0.5.2 _23 June 2022_ * Return assertion instance values starting at `1` instead of `2` ([#60](https://github.com/contentauth/c2pa-rs/pull/60)) ## 0.5.1 _22 June 2022_ * Update thumbnail to be `Vec`, add serialization feature ([#59](https://github.com/contentauth/c2pa-rs/pull/59)) * Adds xmp_write feature to make xmp-toolkit inclusion optional ([#53](https://github.com/contentauth/c2pa-rs/pull/53)) ## 0.5.0 _20 June 2022_ * (MINOR) Add asset attribute getters for manifest ([#56](https://github.com/contentauth/c2pa-rs/pull/56)) * (MINOR) Remove temp_signer from sdk; update docs and examples to use get_signer_from_files ([#52](https://github.com/contentauth/c2pa-rs/pull/52)) * (MINOR) Clean up client example; update actions and schema ([#51](https://github.com/contentauth/c2pa-rs/pull/51)) ## 0.4.2 _16 June 2022_ * Fix bug in updating crate reference in README ([#50](https://github.com/contentauth/c2pa-rs/pull/50)) ## 0.4.1 _16 June 2022_ * Fix bug in Cargo.toml updates ([#49](https://github.com/contentauth/c2pa-rs/pull/49)) ## 0.4.0 _16 June 2022_ * Add status badges for CI validation, crates.io, and code coverage ([#46](https://github.com/contentauth/c2pa-rs/pull/46)) * Remove self-signed end-entity cert support ([#48](https://github.com/contentauth/c2pa-rs/pull/48)) * Add rustfmt toml to get edition 2018 formatting ([#36](https://github.com/contentauth/c2pa-rs/pull/36)) * (MINOR) Update from_bytes(_async) to return a Result ([#43](https://github.com/contentauth/c2pa-rs/pull/43)) * Adjust temp signer reserved sizes to account for large timestamps ([#45](https://github.com/contentauth/c2pa-rs/pull/45)) * Fix bug in verify_from_buffer ([#44](https://github.com/contentauth/c2pa-rs/pull/44)) * Remove cargo edit from publish workflow ([#42](https://github.com/contentauth/c2pa-rs/pull/42)) * Apply fix from c2patool publish workflow ([#40](https://github.com/contentauth/c2pa-rs/pull/40)) * Remove need for using OpenSSL to generate certs by using pre-generated certs ([#41](https://github.com/contentauth/c2pa-rs/pull/41)) * Update README and pull request template with formatting changes ([#38](https://github.com/contentauth/c2pa-rs/pull/38)) ## 0.3.0 _08 June 2022_ * Make most jumbf_io functions crate private and move Store dependencies to Store ([#37](https://github.com/contentauth/c2pa-rs/pull/37)) * Remove c2patool source now that it's in its own repo ([#35](https://github.com/contentauth/c2pa-rs/pull/35)) * (MINOR) Update ManifestAssertion supporting instances ([#34](https://github.com/contentauth/c2pa-rs/pull/34)) * Export top level signing functions, hide other signature details ([#32](https://github.com/contentauth/c2pa-rs/pull/32)) * Add documentation for the `Actions` and `Metadata` assertions ([#30](https://github.com/contentauth/c2pa-rs/pull/30)) * Rework how c2patool is configured ([#28](https://github.com/contentauth/c2pa-rs/pull/28)) * Convert make_tests into a scriptable engine; rename to make_test_images ([#29](https://github.com/contentauth/c2pa-rs/pull/29)) * Update thiserror requirement from >= 1.0.20, < 1.0.26 to >= 1.0.20, < 1.0.32 in /sdk ([#9](https://github.com/contentauth/c2pa-rs/pull/9)) * Update base64 requirement from 0.12.2 to 0.13.0 in /sdk ([#10](https://github.com/contentauth/c2pa-rs/pull/10)) * Update range-set requirement from 0.0.7 to 0.0.9 in /sdk ([#13](https://github.com/contentauth/c2pa-rs/pull/13)) * Make Assertions opaque in the public SDK ([#22](https://github.com/contentauth/c2pa-rs/pull/22)) * Update c2pa requirement from 0.1 to 0.2 in /c2patool ([#23](https://github.com/contentauth/c2pa-rs/pull/23)) ## 0.2.0 _26 May 2022_ * Fix dependency reference from c2patool crate to c2pa crate ([#21](https://github.com/contentauth/c2pa-rs/pull/21)) * (MINOR) Detailed API review for Ingredient struct ([#17](https://github.com/contentauth/c2pa-rs/pull/17)) ## 0.1.3 _26 May 2022_ * Publish c2patool crate ([#20](https://github.com/contentauth/c2pa-rs/pull/20)) * Improve documentation ([#14](https://github.com/contentauth/c2pa-rs/pull/14)) ## 0.1.2 _26 May 2022_ * No-op change to verify correct handling of PR numbers ([#19](https://github.com/contentauth/c2pa-rs/pull/19)) * Fix error in formatting changelog * Fix missing links in changelog ## 0.1.1 _26 May 2022_ * Add Makefile for local testing ([#18](https://github.com/contentauth/c2pa-rs/pull/18)) * Add workflow for automatically releasing c2pa crate ([#16](https://github.com/contentauth/c2pa-rs/pull/16)) * Reduce fixtures size ([#15](https://github.com/contentauth/c2pa-rs/pull/15)) * Add codecov.io integration ([#4](https://github.com/contentauth/c2pa-rs/pull/4)) * Configure dependabot ([#8](https://github.com/contentauth/c2pa-rs/pull/8)) * Configure dependabot ([#7](https://github.com/contentauth/c2pa-rs/pull/7)) * Remove unnecessary steps from cargo-deny job ([#6](https://github.com/contentauth/c2pa-rs/pull/6)) * Update to latest GH Actions checkout action ([#5](https://github.com/contentauth/c2pa-rs/pull/5)) * Change ring license hash to decimal ([#3](https://github.com/contentauth/c2pa-rs/pull/3)) ## 0.1.0 _23 May 2022_ * Initial public release