chore(release): 0.37.13.dev2 with conformance-validation-v02 merged

.github/workflows/castlabs-vsi-pypi.yml

@@ -6,11 +6,11 @@ on:
       release_tag:
         description: Existing immutable Castlabs prerelease tag
         required: true
-        default: castlabs-v0.37.13.dev1
+        default: castlabs-v0.37.13.dev2
         type: string
 
 concurrency:
-  group: castlabs-vsi-pypi-0.37.13.dev1
+  group: castlabs-vsi-pypi-0.37.13.dev2
   cancel-in-progress: false
 
 permissions:
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-python
-          ref: castlabs-v0.37.13.dev1
+          ref: castlabs-v0.37.13.dev2
           fetch-depth: 0
           path: c2pa-python
 
@@ -45,13 +45,13 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
-          test "${INPUT_RELEASE_TAG}" = castlabs-v0.37.13.dev1
-          test "$(python3 c2pa-python/scripts/castlabs_release.py lock-value package.version)" = 0.37.13.dev1
-          test "$(gh api repos/castlabs/c2pa-python/releases/tags/castlabs-v0.37.13.dev1 --jq '(.draft == false and .prerelease == true)')" = true
+          test "${INPUT_RELEASE_TAG}" = castlabs-v0.37.13.dev2
+          test "$(python3 c2pa-python/scripts/castlabs_release.py lock-value package.version)" = 0.37.13.dev2
+          test "$(gh api repos/castlabs/c2pa-python/releases/tags/castlabs-v0.37.13.dev2 --jq '(.draft == false and .prerelease == true)')" = true
           SOURCE_SHA=$(git -C c2pa-python rev-parse HEAD)
-          test "$(git -C c2pa-python rev-list -n 1 castlabs-v0.37.13.dev1)" = "$SOURCE_SHA"
+          test "$(git -C c2pa-python rev-list -n 1 castlabs-v0.37.13.dev2)" = "$SOURCE_SHA"
           mkdir -p download dist
-          gh release download castlabs-v0.37.13.dev1 \
+          gh release download castlabs-v0.37.13.dev2 \
             --repo castlabs/c2pa-python --dir download
           python3 c2pa-python/scripts/castlabs_release.py validate-release-assets \
             --assets-dir download
@@ -63,29 +63,29 @@ jobs:
               --repo castlabs/c2pa-python \
               --signer-workflow castlabs/c2pa-python/.github/workflows/castlabs-vsi-release.yml \
               --signer-digest "$SOURCE_SHA" \
-              --source-ref refs/tags/castlabs-v0.37.13.dev1 \
+              --source-ref refs/tags/castlabs-v0.37.13.dev2 \
               --source-digest "$SOURCE_SHA" \
               --deny-self-hosted-runners
           done
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.13.dev1-py3-none-wheels.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev2-py3-none-wheels.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py extract \
-            --archive download/c2pa-python-0.37.13.dev1-py3-none-wheels.tar.gz \
+            --archive download/c2pa-python-0.37.13.dev2-py3-none-wheels.tar.gz \
             --destination dist
           test "$(find dist -maxdepth 1 -name '*.whl' | wc -l)" -eq 2
-          cmp dist/c2pa_python-0.37.13.dev1-py3-none-manylinux_2_28_x86_64.whl \
-            download/c2pa_python-0.37.13.dev1-py3-none-manylinux_2_28_x86_64.whl
-          cmp dist/c2pa_python-0.37.13.dev1-py3-none-win_amd64.whl \
-            download/c2pa_python-0.37.13.dev1-py3-none-win_amd64.whl
+          cmp dist/c2pa_python-0.37.13.dev2-py3-none-manylinux_2_28_x86_64.whl \
+            download/c2pa_python-0.37.13.dev2-py3-none-manylinux_2_28_x86_64.whl
+          cmp dist/c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl \
+            download/c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl
           python3 -m pip install packaging==25.0 twine==6.2.0
-          python3 -c 'from packaging.version import Version; v=Version("0.37.13.dev1"); assert v.is_prerelease and str(v)=="0.37.13.dev1"'
+          python3 -c 'from packaging.version import Version; v=Version("0.37.13.dev2"); assert v.is_prerelease and str(v)=="0.37.13.dev2"'
           python3 -m twine check dist/*.whl
 
       - name: Preflight retry-safe PyPI upload set
@@ -94,7 +94,7 @@ jobs:
         run: |
           STATUS=$(curl --silent --show-error --location \
             --output pypi-response.json --write-out '%{http_code}' \
-            https://pypi.org/pypi/c2pa-python/0.37.13.dev1/json)
+            https://pypi.org/pypi/c2pa-python/0.37.13.dev2/json)
           case "$STATUS" in
             200|404) ;;
             *) echo "unexpected PyPI JSON API status: $STATUS" >&2; exit 1 ;;

.github/workflows/castlabs-vsi-release.yml

@@ -3,11 +3,11 @@ name: Castlabs VSI prerelease
 on:
   push:
     tags:
-      - castlabs-v0.37.13.dev1
+      - castlabs-v0.37.13.dev2
   workflow_dispatch:
     inputs:
       source_sha:
-        description: Full Python SHA (feat/trusted-vsi-functional tip for 0.37.13.dev1; paired source for trusted_vsi_only)
+        description: Full Python SHA (feat/trusted-vsi-functional tip for 0.37.13.dev2; paired source for trusted_vsi_only)
         required: true
         type: string
       trusted_vsi_only:
@@ -17,7 +17,7 @@ on:
         default: false
 
 concurrency:
-  group: castlabs-vsi-release-0.37.13.dev1
+  group: castlabs-vsi-release-0.37.13.dev2
   cancel-in-progress: false
 
 permissions:
@@ -72,7 +72,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
+          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
           fetch-depth: 1
           path: c2pa-rs
 
@@ -123,7 +123,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
+          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
           fetch-depth: 1
           path: c2pa-rs
 
@@ -195,7 +195,7 @@ jobs:
               test "$(find wheelhouse -maxdepth 1 -name "*.whl" | wc -l)" -eq 1
               WHEEL=$(find wheelhouse -maxdepth 1 -name "*.whl")
               case "$(basename "$WHEEL")" in
-                c2pa_python-0.37.13.dev1-py3-none-manylinux_2_28_x86_64.whl) ;;
+                c2pa_python-0.37.13.dev2-py3-none-manylinux_2_28_x86_64.whl) ;;
                 *) echo "unexpected Linux wheel: $WHEEL" >&2; exit 1 ;;
               esac
               /opt/python/cp310-cp310/bin/python -m auditwheel show "$WHEEL"
@@ -215,7 +215,7 @@ jobs:
           SOURCE_DATE_EPOCH: ${{ needs.prepare.outputs.source_epoch }}
         run: |
           cd c2pa-python
-          BUNDLE=release-out/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz
+          BUNDLE=release-out/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz
           python3 scripts/castlabs_release.py pack --output "$BUNDLE" \
             --epoch "$SOURCE_DATE_EPOCH" \
             --member x86_64-unknown-linux-gnu/libc2pa_c.so=release-out/libc2pa_c.so
@@ -278,7 +278,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
+          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
           fetch-depth: 1
           path: c2pa-rs
 
@@ -351,7 +351,7 @@ jobs:
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           $wheels = @(Get-ChildItem dist/*.whl)
           if ($wheels.Count -ne 1) { throw "expected exactly one Windows wheel" }
-          if ($wheels[0].Name -ne "c2pa_python-0.37.13.dev1-py3-none-win_amd64.whl") {
+          if ($wheels[0].Name -ne "c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl") {
             throw "unexpected Windows wheel $($wheels[0].Name)"
           }
           python -m twine check $wheels[0].FullName
@@ -371,7 +371,7 @@ jobs:
           $ErrorActionPreference = "Stop"
           $PSNativeCommandUseErrorActionPreference = $true
           Push-Location c2pa-python
-          $bundle = "release-out/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz"
+          $bundle = "release-out/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz"
           python scripts/castlabs_release.py pack --output $bundle `
             --epoch $env:SOURCE_DATE_EPOCH `
             --member x86_64-pc-windows-msvc/c2pa_c.dll=release-out/c2pa_c.dll
@@ -424,14 +424,16 @@ jobs:
       - name: Test installed wheel in a clean environment
         shell: bash
         env:
-          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev1
+          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev2
           CASTLABS_RELEASE_SMOKE_REQUIRED: "1"
           C2PA_SOURCE_BUILD_VERSION: 0.92.0-dev
         run: |
           test "$(find release-out -maxdepth 1 -name '*.whl' | wc -l)" -eq 1
           python -m venv "${RUNNER_TEMP}/wheel-test"
           "${RUNNER_TEMP}/wheel-test/bin/python" -m pip install --upgrade pip
           "${RUNNER_TEMP}/wheel-test/bin/python" -m pip install release-out/*.whl
+          # pytest is no longer a runtime dependency of the wheel (upstream 4d909cf).
+          "${RUNNER_TEMP}/wheel-test/bin/python" -m pip install pytest==8.4.1
           "${RUNNER_TEMP}/wheel-test/bin/python" -m pytest -q \
             c2pa-python/tests/test_castlabs_release_smoke.py
           if [[ "${{ matrix.python }}" == "3.10" ]]; then
@@ -464,7 +466,7 @@ jobs:
       - name: Test installed wheel in a clean environment
         shell: pwsh
         env:
-          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev1
+          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev2
           CASTLABS_RELEASE_SMOKE_REQUIRED: "1"
           C2PA_SOURCE_BUILD_VERSION: 0.92.0-dev
         run: |
@@ -476,6 +478,7 @@ jobs:
           & "$env:RUNNER_TEMP\wheel-test\Scripts\python.exe" -m pip install --upgrade pip
           $wheel = (Get-ChildItem release-out/*.whl).FullName
           & "$env:RUNNER_TEMP\wheel-test\Scripts\python.exe" -m pip install $wheel
+          & "$env:RUNNER_TEMP\wheel-test\Scripts\python.exe" -m pip install pytest==8.4.1
           & "$env:RUNNER_TEMP\wheel-test\Scripts\python.exe" -m pytest -q `
             c2pa-python/tests/test_castlabs_release_smoke.py
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
@@ -487,7 +490,7 @@ jobs:
 
   release:
     needs: [prepare, linux, windows, test-linux-wheel, test-windows-wheel]
-    if: github.ref == 'refs/tags/castlabs-v0.37.13.dev1'
+    if: github.ref == 'refs/tags/castlabs-v0.37.13.dev2'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     environment: castlabs-vsi-release
@@ -522,7 +525,7 @@ jobs:
           LINUX_WHEEL=$(find collected/linux -maxdepth 1 -name "*.whl")
           WINDOWS_WHEEL=$(find collected/windows -maxdepth 1 -name "*.whl")
           test "$(find collected/linux collected/windows -name "*.whl" | wc -l)" -eq 2
-          BUNDLE=assets/c2pa-python-0.37.13.dev1-py3-none-wheels.tar.gz
+          BUNDLE=assets/c2pa-python-0.37.13.dev2-py3-none-wheels.tar.gz
           python3 c2pa-python/scripts/castlabs_release.py pack \
             --output "$BUNDLE" --epoch "$SOURCE_DATE_EPOCH" \
             --member "$(basename "$LINUX_WHEEL")=$LINUX_WHEEL" \
@@ -539,13 +542,13 @@ jobs:
           python3 c2pa-python/scripts/castlabs_release.py checksum \
             --artifact "$BUNDLE.evidence.json"
           cp "$LINUX_WHEEL" "$WINDOWS_WHEEL" assets/
-          cp collected/linux/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz* assets/
-          cp collected/windows/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz* assets/
+          cp collected/linux/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz* assets/
+          cp collected/windows/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz* assets/
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence assets/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz.evidence.json \
+            --evidence assets/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz.evidence.json \
             --artifact-dir assets --source-sha "${{ needs.prepare.outputs.source_sha }}"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence assets/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz.evidence.json \
+            --evidence assets/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz.evidence.json \
             --artifact-dir assets --source-sha "${{ needs.prepare.outputs.source_sha }}"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
             --evidence "$BUNDLE.evidence.json" --artifact-dir assets \
@@ -559,7 +562,7 @@ jobs:
       - name: Require immutable release tag
         shell: bash
         run: |
-          TAG=castlabs-v0.37.13.dev1
+          TAG=castlabs-v0.37.13.dev2
           git -C c2pa-python fetch origin "refs/tags/${TAG}:refs/tags/${TAG}"
           test "$(git -C c2pa-python rev-list -n 1 "$TAG")" = \
             "${{ needs.prepare.outputs.source_sha }}"
@@ -575,7 +578,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          TAG=castlabs-v0.37.13.dev1
+          TAG=castlabs-v0.37.13.dev2
           SOURCE_SHA="${{ needs.prepare.outputs.source_sha }}"
           RELEASE_NAME=$(python3 c2pa-python/scripts/castlabs_release.py release-value name)
           RELEASE_BODY=$(python3 c2pa-python/scripts/castlabs_release.py release-value body)
@@ -601,7 +604,7 @@ jobs:
           }
           discover_release() {
             gh api --paginate repos/castlabs/c2pa-python/releases \
-              --jq '.[] | select(.tag_name == "castlabs-v0.37.13.dev1")' > "$1"
+              --jq '.[] | select(.tag_name == "castlabs-v0.37.13.dev2")' > "$1"
             return 0
           }
           query_release_id() {

.github/workflows/trusted-vsi-paired.yml

@@ -35,9 +35,9 @@ jobs:
       C2PA_REQUIRE_SIGN_LADDER: "1"
       C2PA_REQUIRE_FRAGMENTED_FILES: "1"
       C2PA_FRAGMENT_OFFSET_REQUIRED: "1"
-      FUNCTIONAL_BUILD_VERSION: 0.37.13.dev1
+      FUNCTIONAL_BUILD_VERSION: 0.37.13.dev2
       # The release smoke asserts the installed distribution version.
-      CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev1
+      CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev2
     steps:
       - name: Require a full Python source SHA
         shell: bash
@@ -52,9 +52,9 @@ jobs:
         with:
           repository: castlabs/c2pa-rs
           # Revision-3 trusted VSI plus offset-aware fragment verification:
-          # the same native commit the 0.37.13.dev1 release lock pins. This job
+          # the same native commit the 0.37.13.dev2 release lock pins. This job
           # is qualification-only and never produces release artifacts.
-          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
+          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
           path: paired-rust
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with: