Repository navigation
Step 74: c2pa-node 0.9.10, the trust migration works and signing lost its timestamp - #185
Merged
Merged
Conversation
… its timestamp Records the 0.9.10 bump attempt. The Context migration and SPEC-014 Amendment 1 are measured green, and specVersion signs and reads back. The bump is held because c2pa-node 0.9.8 and later sign without an RFC 3161 timestamp on the CallbackSigner/signAsync path, even against an unreachable TSA (contentauth/c2pa-js#244). Also recorded: verify after sign in c2pa-rs 0.91 and the SPEC-007 AC5 test it fooled (fixed in #184), and a stray test server on port 3999.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds NOTES Step 74 and its rows in the index. Notes only: nothing in
src/,service/ordocs/, andnotes/is not in the dist.The step records the attempt to bump
@contentauth/c2pa-nodefrom 0.9.5 to 0.9.10 (c2pa-rs 0.91.3):Contextmigration and SPEC-014 Amendment 1 are measured green on 0.9.10. AC10 (allowed list beside non-covering anchors readsTrusted) was only reasoned before; now it is measured.specVersionsigns and reads back.CallbackSigner/signAsyncpath, even against an unreachable TSA. Measured per version: 0.9.5 and 0.9.7 timestamp, 0.9.8 and 0.9.10 do not. Reported as c2pa-node 0.9.8+: CallbackSigner no longer timestamps on signAsync contentauth/c2pa-js#244, and Dependabot's chore(service): bump @contentauth/c2pa-node from 0.9.5 to 0.9.9 in /service #168 is closed for it.AuditLoggingTestinside the container.The step keeps measured and reasoned claims apart, since
notes/is public.composer check: 519 passed, 7 skipped.bin/spec-check.php: 0 errors, 0 unresolved.