Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

0.26.47

09 April 2026

0.26.46

08 April 2026

Fixed

• Allow any file type to be signed with a sidecar (#2014)

0.26.45

07 April 2026

0.26.44

03 April 2026

0.26.43

31 March 2026

0.26.42

27 March 2026

Fixed

• Updated crJSON Schema (#1975)

Other

• Update x_509.md (#1942)

0.26.41

23 March 2026

0.26.40

23 March 2026

Added

• Add cr_json() and cr_json_value() to Reader; remove separate CrJsonReader (#1919)

0.26.39

16 March 2026

Fixed

• Pin atree to 0.5.2 (#1940)

0.26.38

13 March 2026

0.26.37

12 March 2026

0.26.36

12 March 2026

0.26.35

11 March 2026

0.26.34

10 March 2026

0.26.33

04 March 2026

0.26.32

03 March 2026

0.26.31

02 March 2026

Updated dependencies

• Bump toml from 0.9.12+spec-1.1.0 to 1.0.2+spec-1.1.0 (#1883)

0.26.30

23 February 2026

0.26.29

12 February 2026

0.26.28

12 February 2026

0.26.27

09 February 2026

0.26.26

06 February 2026

0.26.25

06 February 2026

0.26.24

03 February 2026

0.26.23

03 February 2026

0.26.22

03 February 2026

0.26.21

02 February 2026

0.26.20

30 January 2026

0.26.19

28 January 2026

0.26.18

27 January 2026

Documented

• Remove outdated ref to CreativeWork, other small edits (#1770)

0.26.17

22 January 2026

0.26.16

21 January 2026

0.26.15

16 January 2026

0.26.14

16 January 2026

0.26.13

15 January 2026

0.26.12

15 January 2026

Fixed

• Verify after sign not executing (#1638)

0.26.11

14 January 2026

Updated dependencies

• Bump toml from 0.8.23 to 0.9.10+spec-1.1.0 (#1713)
• Bump etcetera from 0.10.0 to 0.11.0 (#1712)
• Bump env_logger from 0.10.2 to 0.11.8 (#1711)
• Bump mockall from 0.13.1 to 0.14.0 (#1708)

0.26.10

07 January 2026

0.26.9

22 December 2025

0.26.8

19 December 2025

0.26.7

04 December 2025

0.26.6

04 December 2025

Added

• Support JSON settings in c2patool (#1635)

Documented

• Add doc for CLI settings, misc copy edits (#1636)

0.26.5

17 November 2025

0.26.4

17 November 2025

0.26.3

13 November 2025

0.26.2

12 November 2025

Fixed

• Use Digitalsourcetype with Builder intents (#1586)

0.26.1

07 November 2025

0.26.0

06 November 2025

Added

• Sync/async HTTP resolvers API (#1355)

0.25.0

04 November 2025

Added

• Allow reading a manifest store as a Builder to continue editing (#1476)

Fixed

• Update to avoid deprecation warning for Command::cargo_bin (#1548)

Other

• Revert "chore: release (#1535)"

0.24.0

24 October 2025

Added

• Add settings structs to the public API (#1447)

Documented

• Change relative to absolute URLs (#1418)

Fixed

• Timestamp grace for legacy manifests (#1502)
• Turn on trust by default (#1483)

Other

• Update httpmock to 0.8.0 (#1472)

Updated dependencies

• Bump pem from 3.0.5 to 3.0.6 (#1511)
• Bump clap from 4.5.47 to 4.5.50 (#1506)
• Bump httpmock from 0.8.1 to 0.8.2 (#1504)

0.23.4

02 October 2025

0.23.3

30 September 2025

Fixed

• AllActionsIncluded defaults to None (#1459)

0.23.2

24 September 2025

Fixed

• We lost the ability to read the deprecated instanceId actions parameters field. (#1443)

0.23.1

23 September 2025

Documented

• Document --external-manifest c2patool argument (#1435)

0.23.0

19 September 2025

Added

• Allow specifying external binary manifest to c2patool (#1428)

0.22.1

15 September 2025

0.22.0

10 September 2025

Added

• Remove the v1_api feature and all associated code (#1387)

0.21.0

06 September 2025

Added

• Implement CAWG X.509 signing via settings (#1388)

0.20.4

03 September 2025

0.20.3

27 August 2025

0.20.2

26 August 2025

0.20.1

15 August 2025

Changelog

All changes to C2PA Tool are documented in this file. For additional information on versions 0.9.x and earlier, see the Archived release motes.

This project adheres to Semantic Versioning, except that – as is typical in the Rust community – the minimum supported Rust version may be increased without a major version increase.

Since version 0.10.0, the format of this changelog is based on Keep a Changelog.

0.20.0

14 August 2025

Added

• Add option for configuring trust when validating identity assertions (CAI-7980) (#1239)
• V2 Claims are now generated by default (#1266)
• Expand settings API (#1192)

Fixed

• Same file sign for c2patool (#1220)

0.19.1

18 July 2025

Fixed

• Clippy warnings for Rust 1.88 (#1204)
• Fix c2patool --info command. (#1190)

0.19.0

17 June 2025

Added

• Update Validation for 2.2 spec compliance (#1144)

Documented

• Doc cleanup (#1143)

0.18.0

27 May 2025

Added

• Make OpenSSL a default feature (#1118)

Fixed

• Remove use of workspace versioning for the moment (#1136)
• Add CAWG support for fragmented BMFF (#1114)

Other

• Remove unreleased changes to c2patool
• Integrates prebuilt library release workflow (#1126)

0.17.0

16 May 2025

Added

• [breaking] Merge CAWG identity SDK into main C2PA crate (#1089)

Documented

• Replace old c2patool release notes with CHANGELOG (#1063)

0.16.6

14 May 2025

Documented

• Replace old c2patool release notes with CHANGELOG (#1063)

0.16.5

25 April 2025

Fixed

• Enable post_validate_async for WASI (#1052)

0.16.4

16 April 2025

Documented

• Remove instructions to install c2patool using binstall (#1038)

Fixed

• Dynamic assertions should be gathered assertions (#1005)

0.16.3

07 April 2025

Fixed

• Adjust dependencies to avoid security warnings and yanked versions (#1031)

0.16.2

04 April 2025

Fixed

• Update openssl to address a recently-announced vulnerability (#1024)

0.16.1

26 March 2025

• Update to latest c2pa-crypto crate

0.15.0

18 March 2025

Added

• Adds reader.post_validate method for CAWG validation support (#976)
• Add WASI to c2patool (#945)

Fixed

• Remove circular dependency between C2PA and CAWG crates (#982)

Updated dependencies

• Bump env_logger from 0.11.6 to 0.11.7 (#963)

0.13.3

11 February 2025

Fixed

• Trigger a release of c2patool to pick up latest c2pa-rs changes

0.13.1

31 January 2025

Fixed

• Trigger a release of c2patool to pick up latest c2pa-rs changes (#895)

0.13.0

29 January 2025

Added

• Claim v2 (#707)

0.12.0

22 January 2025

Added

• Change the definition of Signer.raw_signer() to return an Option defaulting to None (#869)

0.11.1

18 January 2025

Fixed

• Upload a distinct SBOM per platform (#856)

0.11.0

16 January 2025

Added

• Move COSE signing into c2pa_crypto crate (#807)

Documented

• Post move cleanup (#778)

Fixed

• Fix: Obscure glob error message for missing files

0.10.2

12 December 2024

Fixed

• No-op change to trigger new c2patool build
• Update makefile for c2patool's new location in c2pa-rs workspace

0.10.1

12 December 2024

Fixed

• No-op change to trigger new c2patool release

0.10.0

12 December 2024

Added

• Updates c2patool to use only the new Builder/Reader API (contentauth/c2patool#297)

Documented

• Update Contributing guide, misc minor edits (contentauth/c2patool#296)

Fixed

• Compile c2pa-crypto with cargo check (#768)

Other

• Move c2patool source code into c2pa-rs repo (#723)
• Move profile settings to workspace Cargo.toml
• Enlarged description of c2pa command-line behavior (contentauth/c2patool#285)

0.9.12

18 October 2024

• fix: Update c2pa-rs for RegionOfInterest support. (contentauth/c2patool#269)
• Fix broken link that was causing os site workflow to fail (contentauth/c2patool#266)
• Bump codecov/codecov-action from 3 to 4 (contentauth/c2patool#242)
• chore: Run all CI jobs when user is dependabot[bot]
• chore: Debug CI again
• chore: Format for consistency with c2pa-rs CI workflow (contentauth/c2patool#265)
• chore: Don't skip CI jobs for non-pull-request events
• chore: Retry debug
• chore: Debug action context
• chore: Skip CodeCov upload for non-member PRs (contentauth/c2patool#263)
• Bump EmbarkStudios/cargo-deny-action from 1 to 2 (contentauth/c2patool#245)
• chore: Adjust conditions for running CI jobs (contentauth/c2patool#261)

0.9.11

16 October 2024

• Merge hardening bug fixes (contentauth/c2patool#260)

0.9.10

07 October 2024

• Update c2ptool to use latest c2pa-rs (contentauth/c2patool#258)

0.9.9

17 September 2024

• Pull in latest bug fixes (contentauth/c2patool#237)
• Document fragment subcommand (contentauth/c2patool#236)
• Switch back to using pull_request instead of pull_request_target trigger
• Bump actions/checkout from 3 to 4 (contentauth/c2patool#243)
• Remove no-longer-maintained clippy-check action (contentauth/c2patool#238)

0.9.8

30 August 2024

• Initial fragment support (contentauth/c2patool#230)
• Add warning about accessing a private key directly (contentauth/c2patool#218)

0.9.7

15 August 2024

• Update to latest c2pa SDK (contentauth/c2patool#222)
• Remove rust toolchain version lock (contentauth/c2patool#221)
• Update security guidance to link to SECURITY.md (contentauth/c2patool#217)

0.9.6

30 July 2024

• Pull latest c2pa-rs bug fixes into c2patool (contentauth/c2patool#212)
• only run tests/clippy if labeled (contentauth/c2patool#205)
• Bump env_logger from 0.10.2 to 0.11.4 (contentauth/c2patool#204)
• Updates cargo packages and cargo.deny file. (contentauth/c2patool#200)

0.9.5

18 July 2024

• Update to lastest c2pa-rs (contentauth/c2patool#197)
• added security.md (contentauth/c2patool#196)

0.9.4

25 June 2024

• Update c2patool (contentauth/c2patool#190)
• Match c2pa-rs minimum toolchain version and test in CI (contentauth/c2patool#188)
• Document how to specify an icon (contentauth/c2patool#182)

0.9.3

29 May 2024

• Remove binary modules (contentauth/c2patool#179)

0.9.2

24 May 2024

• Remove integration tests for now due to extraneous binaries (contentauth/c2patool#178)

0.9.1

22 May 2024

• Add better support for cargo-binstall (contentauth/c2patool#177)

0.9.0

07 May 2024

• Integrate with c2pa-rs 0.32.0, various test case fixes. (contentauth/c2patool#175)
• Add HTTP source option for trust config (contentauth/c2patool#174)

0.8.2

28 March 2024

• fixed c2patool asset name (contentauth/c2patool#171)

0.8.1

25 March 2024

• use c2pa-rs 0.31.1 for actions.changes support (contentauth/c2patool#170)

0.8.0

20 March 2024

• allow clients to sign with a process outside of c2patool (contentauth/c2patool#169)
• Add trust and verification options to c2pa_tool (contentauth/c2patool#168)
• adds version to c2patool artifact names (contentauth/c2patool#158)

0.7.0

22 November 2023

• updates to c2pa-rs v0.28.2 (contentauth/c2patool#153)
• Update to c2pa-rs 0.28.1

0.6.2

05 October 2023

• update to c2pa 0.27.1 (contentauth/c2patool#146)
• Merge branch 'main' of https://github.com/contentauth/c2patool
• Add Do not train example
• Upgrade to c2pa-rs 0.26.0 (contentauth/c2patool#143)
• Fix issue with docusaurus styling and fix broken links (contentauth/c2patool#138)
• Updates to c2pa-rs 0.25.1 (contentauth/c2patool#128)
• Fix windows release (contentauth/c2patool#132)

0.6.1

24 July 2023

• use compress-archive instead of tar (contentauth/c2patool#130)

0.6.0

22 June 2023

• update to c2pa-rs 0.24.0 (contentauth/c2patool#127)

0.5.4

13 June 2023

• integrate c2pa 23.0 bump version (contentauth/c2patool#126)
• Merge branch 'main' of https://github.com/contentauth/c2patool
• c2pa-rs 23.0 + updated test
• Update README.md (contentauth/c2patool#124)

0.5.3

04 May 2023

• Parent Ingredient JSON (contentauth/c2patool#123)

0.5.2

19 April 2023

• Ingredient thumbnails, extension cleanup, toolkit update (contentauth/c2patool#120)

0.5.1

10 April 2023

• Update README.md (contentauth/c2patool#118)
• Update expired sample certs (contentauth/c2patool#113)

0.5.0

28 March 2023

• New ingredient support and c2pa file formats (contentauth/c2patool#111)
• Leverage new Manifest & Ingredient, add Ingredient creation. (contentauth/c2patool#107)

0.4.0

01 March 2023

• Add --certs and --tree options (contentauth/c2patool#106)
• update to cp2pa 0.17.0 (contentauth/c2patool#105)
• Update for Clippy in Rust 1.67 (contentauth/c2patool#101)

0.3.9

06 December 2022

• update to c2pa-rs 0.16.0
• allows clients to output manifest report to specified directory (contentauth/c2patool#91)

0.3.8

09 November 2022

• Bump c2pa from 0.13.2 to 0.15.0 (contentauth/c2patool#87)
• Build infrastructure improvements (contentauth/c2patool#85)
• Fix new Clippy warning in Rust 1.65 (contentauth/c2patool#84)
• Readme updates (contentauth/c2patool#62)

0.3.7

22 September 2022

• Treat a source asset with a manifest store as a default parent (contentauth/c2patool#76)
• Fetch remote manifests for --info (contentauth/c2patool#75)

0.3.6

16 September 2022

• Update Cargo.lock when publishing crate (contentauth/c2patool#71)
• [IGNORE] update readme --info (contentauth/c2patool#70)
• Update Cargo.lock to 0.3.5

0.3.5

15 September 2022

• Upgrade cpufeatures to non-yanked version (contentauth/c2patool#68)
• Add --info option (contentauth/c2patool#65)
• Updated publish workflow to upload binaries to GitHub (contentauth/c2patool#58)
• Fix Make release script & update readme (contentauth/c2patool#55)
• (Some version history omitted as we worked on some release process issues)

0.3.0

18 August 2022

• Rework c2patool parameters (contentauth/c2patool#53)
• Update to 0.11.0 c2pa-rs (contentauth/c2patool#38)
• Remove Homebrew, Git installation methods, and add "update" wording (contentauth/c2patool#33)

0.2.1

29 June 2022

• Add BMFF support for video & etc (contentauth/c2patool#25)

0.2.0

28 June 2022

• Upgrade to c2pa Rust SDK version 0.6.0 (contentauth/c2patool#24)
• Fix an error in the README documentation (contentauth/c2patool#23)
• Display help if there are no arguments on the command line (contentauth/c2patool#21)
• Bump anyhow from 1.0.57 to 1.0.58 (contentauth/c2patool#17)
• Updates examples to use ta_url instead of ta (contentauth/c2patool#15)

0.1.3

17 June 2022

• Update to latest c2pa Rust SDK (contentauth/c2patool#12)
• Add built-in default certs to make getting started easier (contentauth/c2patool#9)

0.1.2

10 June 2022

• Update crate's description field

0.1.1

10 June 2022

• Initial public release