mstattma · Oct 17, 2026 · Oct 17, 2026
diff --git a/.github/workflows/castlabs-vsi-pypi.yml b/.github/workflows/castlabs-vsi-pypi.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Existing immutable Castlabs prerelease tag
+        description: Existing immutable Castlabs dev-only prerelease tag (no +signer releases)
         required: true
         default: castlabs-v0.37.13.dev2
         type: string
@@ -26,6 +26,13 @@ jobs:
       contents: read
       id-token: write
     steps:
+      - name: Reject non-development release tags before checkout
+        shell: bash
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          [[ "$INPUT_RELEASE_TAG" =~ ^castlabs-v[0-9]+\.[0-9]+\.[0-9]+\.dev[0-9]+$ ]]
+
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-python
@@ -85,7 +92,7 @@ jobs:
           cmp dist/c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl \
             download/c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl
           python3 -m pip install packaging==25.0 twine==6.2.0
-          python3 -c 'from packaging.version import Version; v=Version("0.37.13.dev2"); assert v.is_prerelease and str(v)=="0.37.13.dev2"'
+          python3 -c 'from packaging.version import Version; v=Version("0.37.13.dev2"); assert v.is_devrelease and v.local is None and str(v)=="0.37.13.dev2"'
           python3 -m twine check dist/*.whl
 
       - name: Preflight retry-safe PyPI upload set

diff --git a/.github/workflows/castlabs-vsi-release.yml b/.github/workflows/castlabs-vsi-release.yml
@@ -1,13 +1,13 @@
-name: Castlabs VSI prerelease
+name: Castlabs VSI release
 
 on:
   push:
     tags:
-      - castlabs-v0.37.13.dev2
+      - 'castlabs-v0.37.13\+signer.1.0.8'
   workflow_dispatch:
     inputs:
       source_sha:
-        description: Full Python SHA (feat/trusted-vsi-functional tip for 0.37.13.dev2; paired source for trusted_vsi_only)
+        description: Full Python SHA (feat/trusted-vsi-functional tip for 0.37.13+signer.1.0.8; paired source for trusted_vsi_only)
         required: true
         type: string
       trusted_vsi_only:
@@ -17,7 +17,7 @@ on:
         default: false
 
 concurrency:
-  group: castlabs-vsi-release-0.37.13.dev2
+  group: castlabs-vsi-release-0.37.13+signer.1.0.8
   cancel-in-progress: false
 
 permissions:
@@ -72,7 +72,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
+          ref: 6021100cc5060b06061ca15b634281cfeb97c718
           fetch-depth: 1
           path: c2pa-rs
 
@@ -82,7 +82,7 @@ jobs:
           git -C c2pa-python fetch --no-tags origin \
             refs/heads/feat/trusted-vsi-functional:refs/remotes/origin/feat/trusted-vsi-functional
           EVENT=manual
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then EVENT=tag; fi
+          if [[ "${GITHUB_EVENT_NAME}" == push ]]; then EVENT=tag; fi
           python3 c2pa-python/scripts/castlabs_release.py validate-sources \
             --python-root c2pa-python \
             --rust-root c2pa-rs \
@@ -123,7 +123,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
+          ref: 6021100cc5060b06061ca15b634281cfeb97c718
           fetch-depth: 1
           path: c2pa-rs
 
@@ -133,7 +133,7 @@ jobs:
           git -C c2pa-python fetch --no-tags origin \
             refs/heads/feat/trusted-vsi-functional:refs/remotes/origin/feat/trusted-vsi-functional
           EVENT=manual
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then EVENT=tag; fi
+          if [[ "${GITHUB_EVENT_NAME}" == push ]]; then EVENT=tag; fi
           python3 c2pa-python/scripts/castlabs_release.py validate-sources \
             --python-root c2pa-python --rust-root c2pa-rs \
             --source-sha "${{ needs.prepare.outputs.source_sha }}" \
@@ -195,7 +195,7 @@ jobs:
               test "$(find wheelhouse -maxdepth 1 -name "*.whl" | wc -l)" -eq 1
               WHEEL=$(find wheelhouse -maxdepth 1 -name "*.whl")
               case "$(basename "$WHEEL")" in
-                c2pa_python-0.37.13.dev2-py3-none-manylinux_2_28_x86_64.whl) ;;
+                c2pa_python-0.37.13+signer.1.0.8-py3-none-manylinux_2_28_x86_64.whl) ;;
                 *) echo "unexpected Linux wheel: $WHEEL" >&2; exit 1 ;;
               esac
               /opt/python/cp310-cp310/bin/python -m auditwheel show "$WHEEL"
@@ -215,7 +215,7 @@ jobs:
           SOURCE_DATE_EPOCH: ${{ needs.prepare.outputs.source_epoch }}
         run: |
           cd c2pa-python
-          BUNDLE=release-out/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz
+          BUNDLE=release-out/c2pa-python-0.37.13+signer.1.0.8-native-linux-x86_64.tar.gz
           python3 scripts/castlabs_release.py pack --output "$BUNDLE" \
             --epoch "$SOURCE_DATE_EPOCH" \
             --member x86_64-unknown-linux-gnu/libc2pa_c.so=release-out/libc2pa_c.so
@@ -278,7 +278,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
+          ref: 6021100cc5060b06061ca15b634281cfeb97c718
           fetch-depth: 1
           path: c2pa-rs
 
@@ -303,7 +303,7 @@ jobs:
           }
           git -C c2pa-python fetch --no-tags origin `
             refs/heads/feat/trusted-vsi-functional:refs/remotes/origin/feat/trusted-vsi-functional
-          $event = if ($env:GITHUB_REF.StartsWith("refs/tags/")) { "tag" } else { "manual" }
+          $event = if ($env:GITHUB_EVENT_NAME -eq "push") { "tag" } else { "manual" }
           python c2pa-python/scripts/castlabs_release.py validate-sources `
             --python-root c2pa-python --rust-root c2pa-rs `
             --source-sha "${{ needs.prepare.outputs.source_sha }}" `
@@ -351,7 +351,7 @@ jobs:
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           $wheels = @(Get-ChildItem dist/*.whl)
           if ($wheels.Count -ne 1) { throw "expected exactly one Windows wheel" }
-          if ($wheels[0].Name -ne "c2pa_python-0.37.13.dev2-py3-none-win_amd64.whl") {
+          if ($wheels[0].Name -ne "c2pa_python-0.37.13+signer.1.0.8-py3-none-win_amd64.whl") {
             throw "unexpected Windows wheel $($wheels[0].Name)"
           }
           python -m twine check $wheels[0].FullName
@@ -371,7 +371,7 @@ jobs:
           $ErrorActionPreference = "Stop"
           $PSNativeCommandUseErrorActionPreference = $true
           Push-Location c2pa-python
-          $bundle = "release-out/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz"
+          $bundle = "release-out/c2pa-python-0.37.13+signer.1.0.8-native-windows-x86_64.tar.gz"
           python scripts/castlabs_release.py pack --output $bundle `
             --epoch $env:SOURCE_DATE_EPOCH `
             --member x86_64-pc-windows-msvc/c2pa_c.dll=release-out/c2pa_c.dll
@@ -424,7 +424,7 @@ jobs:
       - name: Test installed wheel in a clean environment
         shell: bash
         env:
-          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev2
+          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13+signer.1.0.8
           CASTLABS_RELEASE_SMOKE_REQUIRED: "1"
           C2PA_SOURCE_BUILD_VERSION: 0.92.0-dev
         run: |
@@ -466,7 +466,7 @@ jobs:
       - name: Test installed wheel in a clean environment
         shell: pwsh
         env:
-          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev2
+          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13+signer.1.0.8
           CASTLABS_RELEASE_SMOKE_REQUIRED: "1"
           C2PA_SOURCE_BUILD_VERSION: 0.92.0-dev
         run: |
@@ -490,7 +490,7 @@ jobs:
 
   release:
     needs: [prepare, linux, windows, test-linux-wheel, test-windows-wheel]
-    if: github.ref == 'refs/tags/castlabs-v0.37.13.dev2'
+    if: github.event_name == 'push' && github.ref == 'refs/tags/castlabs-v0.37.13+signer.1.0.8'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     environment: castlabs-vsi-release
@@ -525,7 +525,7 @@ jobs:
           LINUX_WHEEL=$(find collected/linux -maxdepth 1 -name "*.whl")
           WINDOWS_WHEEL=$(find collected/windows -maxdepth 1 -name "*.whl")
           test "$(find collected/linux collected/windows -name "*.whl" | wc -l)" -eq 2
-          BUNDLE=assets/c2pa-python-0.37.13.dev2-py3-none-wheels.tar.gz
+          BUNDLE=assets/c2pa-python-0.37.13+signer.1.0.8-py3-none-wheels.tar.gz
           python3 c2pa-python/scripts/castlabs_release.py pack \
             --output "$BUNDLE" --epoch "$SOURCE_DATE_EPOCH" \
             --member "$(basename "$LINUX_WHEEL")=$LINUX_WHEEL" \
@@ -542,13 +542,13 @@ jobs:
           python3 c2pa-python/scripts/castlabs_release.py checksum \
             --artifact "$BUNDLE.evidence.json"
           cp "$LINUX_WHEEL" "$WINDOWS_WHEEL" assets/
-          cp collected/linux/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz* assets/
-          cp collected/windows/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz* assets/
+          cp collected/linux/c2pa-python-0.37.13+signer.1.0.8-native-linux-x86_64.tar.gz* assets/
+          cp collected/windows/c2pa-python-0.37.13+signer.1.0.8-native-windows-x86_64.tar.gz* assets/
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence assets/c2pa-python-0.37.13.dev2-native-linux-x86_64.tar.gz.evidence.json \
+            --evidence assets/c2pa-python-0.37.13+signer.1.0.8-native-linux-x86_64.tar.gz.evidence.json \
             --artifact-dir assets --source-sha "${{ needs.prepare.outputs.source_sha }}"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence assets/c2pa-python-0.37.13.dev2-native-windows-x86_64.tar.gz.evidence.json \
+            --evidence assets/c2pa-python-0.37.13+signer.1.0.8-native-windows-x86_64.tar.gz.evidence.json \
             --artifact-dir assets --source-sha "${{ needs.prepare.outputs.source_sha }}"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
             --evidence "$BUNDLE.evidence.json" --artifact-dir assets \
@@ -562,7 +562,7 @@ jobs:
       - name: Require immutable release tag
         shell: bash
         run: |
-          TAG=castlabs-v0.37.13.dev2
+          TAG=castlabs-v0.37.13+signer.1.0.8
           git -C c2pa-python fetch origin "refs/tags/${TAG}:refs/tags/${TAG}"
           test "$(git -C c2pa-python rev-list -n 1 "$TAG")" = \
             "${{ needs.prepare.outputs.source_sha }}"
@@ -572,13 +572,13 @@ jobs:
         with:
           subject-path: assets/*
 
-      - name: Reconcile no-clobber draft prerelease
+      - name: Reconcile no-clobber draft final release
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          TAG=castlabs-v0.37.13.dev2
+          TAG=castlabs-v0.37.13+signer.1.0.8
           SOURCE_SHA="${{ needs.prepare.outputs.source_sha }}"
           RELEASE_NAME=$(python3 c2pa-python/scripts/castlabs_release.py release-value name)
           RELEASE_BODY=$(python3 c2pa-python/scripts/castlabs_release.py release-value body)
@@ -604,7 +604,7 @@ jobs:
           }
           discover_release() {
             gh api --paginate repos/castlabs/c2pa-python/releases \
-              --jq '.[] | select(.tag_name == "castlabs-v0.37.13.dev2")' > "$1"
+              --jq '.[] | select(.tag_name == "castlabs-v0.37.13+signer.1.0.8")' > "$1"
             return 0
           }
           query_release_id() {
@@ -634,10 +634,12 @@ jobs:
                 CLEANUP_ARMED=0
               fi
               local response="release-upload-${upload_index}.json"
+              local encoded_name
+              encoded_name=$(python3 -c 'import sys; from urllib.parse import quote; print(quote(sys.argv[1], safe=""))' "$asset_name")
               gh api --method POST \
                 -H "Content-Type: application/octet-stream" \
                 --input "assets/$asset_name" \
-                "https://uploads.github.com/repos/castlabs/c2pa-python/releases/${RELEASE_ID}/assets?name=${asset_name}" \
+                "https://uploads.github.com/repos/castlabs/c2pa-python/releases/${RELEASE_ID}/assets?name=${encoded_name}" \
                 > "$response"
               python3 c2pa-python/scripts/castlabs_release.py validate-upload-response \
                 --response "$response" --asset "assets/$asset_name"
@@ -669,7 +671,7 @@ jobs:
               -f "target_commitish=$SOURCE_SHA" \
               -f "name=$RELEASE_NAME" \
               -f "body=$RELEASE_BODY" \
-              -F draft=true -F prerelease=true \
+              -F draft=true -F prerelease=false \
               > release-created-response.json
             python3 c2pa-python/scripts/castlabs_release.py extract-release-id \
               --release-json release-created-response.json \

diff --git a/.github/workflows/trusted-vsi-paired.yml b/.github/workflows/trusted-vsi-paired.yml
@@ -35,9 +35,9 @@ jobs:
       C2PA_REQUIRE_SIGN_LADDER: "1"
       C2PA_REQUIRE_FRAGMENTED_FILES: "1"
       C2PA_FRAGMENT_OFFSET_REQUIRED: "1"
-      FUNCTIONAL_BUILD_VERSION: 0.37.13.dev2
+      FUNCTIONAL_BUILD_VERSION: 0.37.13+signer.1.0.8
       # The release smoke asserts the installed distribution version.
-      CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev2
+      CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13+signer.1.0.8
     steps:
       - name: Require a full Python source SHA
         shell: bash
@@ -52,9 +52,9 @@ jobs:
         with:
           repository: castlabs/c2pa-rs
           # Revision-3 trusted VSI plus offset-aware fragment verification:
-          # the same native commit the 0.37.13.dev2 release lock pins. This job
+          # the same native commit the 0.37.13+signer.1.0.8 release lock pins. This job
           # is qualification-only and never produces release artifacts.
-          ref: afd6fffe5a066e0b5b1a14f3f8c7ac189e7f0c95
+          ref: 6021100cc5060b06061ca15b634281cfeb97c718
           path: paired-rust
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
@@ -105,7 +105,7 @@ jobs:
         shell: bash
         working-directory: python-source
         run: python -m pytest -q tests/test_unit_tests_threaded.py -o faulthandler_timeout=120
-      - name: Build separate development wheel and sdist (no publication)
+      - name: Build isolated aligned wheel and sdist (no publication)
         shell: bash
         working-directory: python-source
         run: python scripts/build_trusted_vsi_functional.py --library "$C2PA_LIBRARY_NAME" --out build/functional-qualification