feat: functional trusted VSI binding, ladder signing and ownership hardening

.github/workflows/build.yml

@@ -26,6 +26,17 @@ permissions:
   actions: read
 
 jobs:
+  trusted-vsi-paired:
+    name: Trusted VSI paired-source API (not release artifacts)
+    if: |
+      !startsWith(github.ref, 'refs/tags/castlabs-v') &&
+      (github.event_name != 'pull_request' ||
+       github.event.pull_request.author_association == 'COLLABORATOR' ||
+       github.event.pull_request.author_association == 'MEMBER' ||
+       github.event.pull_request.user.login == 'dependabot[bot]' ||
+       contains(github.event.pull_request.labels.*.name, 'safe to test'))
+    uses: ./.github/workflows/trusted-vsi-paired.yml
+
   read-version:
     name: Read C2PA version
     if: ${{ !startsWith(github.ref, 'refs/tags/castlabs-v') }}
@@ -144,7 +155,10 @@ jobs:
           python3 -c "from c2pa import C2paError; print('C2paError imported successfully')"
 
       - name: Run tests
-        run: python3 ./tests/test_unit_tests.py
+        run: python3 -m pytest tests/test_unit_tests.py tests/test_sign_ladder.py
+
+      - name: Test disabled trusted API against upstream native (not ABI qualification)
+        run: python3 -m pytest -q tests/test_trusted_vsi_api.py -k "not paired"
 
   tests-windows:
     name: Unit tests for developer setup (Windows)
@@ -230,7 +244,10 @@ jobs:
           python -c "from c2pa import C2paError; print('C2paError imported successfully')"
 
       - name: Run tests
-        run: python .\tests\test_unit_tests.py
+        run: python -m pytest .\tests\test_unit_tests.py .\tests\test_sign_ladder.py
+
+      - name: Test disabled trusted API against upstream native (not ABI qualification)
+        run: python -m pytest -q tests/test_trusted_vsi_api.py -k "not paired"
 
   build-linux-wheel:
     name: Build Linux wheel
@@ -315,7 +332,7 @@ jobs:
       - name: Run tests with pytest (venv)
         run: |
           source venv/bin/activate
-          venv/bin/pytest tests/test_unit_tests.py -v
+          venv/bin/pytest tests/test_unit_tests.py tests/test_sign_ladder.py -v
 
   build-windows-wheel:
     name: Build Windows wheel
@@ -407,7 +424,7 @@ jobs:
       - name: Run tests with pytest (venv)
         run: |
           .\venv\Scripts\activate
-          .\venv\Scripts\pytest .\tests\test_unit_tests.py -v
+          .\venv\Scripts\pytest .\tests\test_unit_tests.py .\tests\test_sign_ladder.py -v
 
   build-macos-wheel:
     name: Build macOS wheels
@@ -496,7 +513,7 @@ jobs:
       - name: Run tests with pytest (venv)
         run: |
           source venv/bin/activate
-          venv/bin/pytest tests/test_unit_tests.py -v
+          venv/bin/pytest tests/test_unit_tests.py tests/test_sign_ladder.py -v
 
   sdist:
     runs-on: ubuntu-latest

.github/workflows/castlabs-vsi-pypi.yml

@@ -4,13 +4,13 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Existing immutable Castlabs prerelease tag
+        description: Existing immutable Castlabs dev-only prerelease tag (no +signer releases)
         required: true
-        default: castlabs-v0.37.8.dev5
+        default: castlabs-v0.37.13.dev2
         type: string
 
 concurrency:
-  group: castlabs-vsi-pypi-0.37.8.dev5
+  group: castlabs-vsi-pypi-0.37.13.dev2
   cancel-in-progress: false
 
 permissions:
@@ -26,10 +26,17 @@ jobs:
       contents: read
       id-token: write
     steps:
+      - name: Reject non-development release tags before checkout
+        shell: bash
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          [[ "$INPUT_RELEASE_TAG" =~ ^castlabs-v[0-9]+\.[0-9]+\.[0-9]+\.dev[0-9]+$ ]]
+
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-python
-          ref: castlabs-v0.37.8.dev5
+          ref: castlabs-v0.37.13.dev2
           fetch-depth: 0
           path: c2pa-python
 
@@ -45,13 +52,13 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
-          test "${INPUT_RELEASE_TAG}" = castlabs-v0.37.8.dev5
-          test "$(python3 c2pa-python/scripts/castlabs_release.py lock-value package.version)" = 0.37.8.dev5
-          test "$(gh api repos/castlabs/c2pa-python/releases/tags/castlabs-v0.37.8.dev5 --jq '(.draft == false and .prerelease == true)')" = true
+          test "${INPUT_RELEASE_TAG}" = castlabs-v0.37.13.dev2
+          test "$(python3 c2pa-python/scripts/castlabs_release.py lock-value package.version)" = 0.37.13.dev2
+          test "$(gh api repos/castlabs/c2pa-python/releases/tags/castlabs-v0.37.13.dev2 --jq '(.draft == false and .prerelease == true)')" = true
           SOURCE_SHA=$(git -C c2pa-python rev-parse HEAD)
-          test "$(git -C c2pa-python rev-list -n 1 castlabs-v0.37.8.dev5)" = "$SOURCE_SHA"
+          test "$(git -C c2pa-python rev-list -n 1 castlabs-v0.37.13.dev2)" = "$SOURCE_SHA"
           mkdir -p download dist
-          gh release download castlabs-v0.37.8.dev5 \
+          gh release download castlabs-v0.37.13.dev2 \
             --repo castlabs/c2pa-python --dir download
           python3 c2pa-python/scripts/castlabs_release.py validate-release-assets \
             --assets-dir download
@@ -63,29 +70,29 @@ jobs:
               --repo castlabs/c2pa-python \
               --signer-workflow castlabs/c2pa-python/.github/workflows/castlabs-vsi-release.yml \
               --signer-digest "$SOURCE_SHA" \
-              --source-ref refs/tags/castlabs-v0.37.8.dev5 \
+              --source-ref refs/tags/castlabs-v0.37.13.dev2 \
               --source-digest "$SOURCE_SHA" \
               --deny-self-hosted-runners
           done
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.8.dev5-native-linux-x86_64.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.8.dev5-native-windows-x86_64.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.8.dev5-py3-none-wheels.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev2-py3-none-wheels.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py extract \
-            --archive download/c2pa-python-0.37.8.dev5-py3-none-wheels.tar.gz \
+            --archive download/c2pa-python-0.37.13.dev2-py3-none-wheels.tar.gz \
             --destination dist
           test "$(find dist -maxdepth 1 -name '*.whl' | wc -l)" -eq 2
-          cmp dist/c2pa_python-0.37.8.dev5-py3-none-manylinux_2_28_x86_64.whl \
-            download/c2pa_python-0.37.8.dev5-py3-none-manylinux_2_28_x86_64.whl
-          cmp dist/c2pa_python-0.37.8.dev5-py3-none-win_amd64.whl \
-            download/c2pa_python-0.37.8.dev5-py3-none-win_amd64.whl
+          cmp dist/c2pa_python-0.37.13.dev2-py3-none-manylinux_2_28_x86_64.whl \
+            download/c2pa_python-0.37.13.dev2-py3-none-manylinux_2_28_x86_64.whl
+          cmp dist/c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl \
+            download/c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl
           python3 -m pip install packaging==25.0 twine==6.2.0
-          python3 -c 'from packaging.version import Version; v=Version("0.37.8.dev5"); assert v.is_prerelease and str(v)=="0.37.8.dev5"'
+          python3 -c 'from packaging.version import Version; v=Version("0.37.13.dev2"); assert v.is_devrelease and v.local is None and str(v)=="0.37.13.dev2"'
           python3 -m twine check dist/*.whl
 
       - name: Preflight retry-safe PyPI upload set
@@ -94,7 +101,7 @@ jobs:
         run: |
           STATUS=$(curl --silent --show-error --location \
             --output pypi-response.json --write-out '%{http_code}' \
-            https://pypi.org/pypi/c2pa-python/0.37.8.dev5/json)
+            https://pypi.org/pypi/c2pa-python/0.37.13.dev2/json)
           case "$STATUS" in
             200|404) ;;
             *) echo "unexpected PyPI JSON API status: $STATUS" >&2; exit 1 ;;