feat: functional trusted VSI binding, ladder signing and ownership hardening

.github/workflows/build.yml

@@ -26,6 +26,17 @@ permissions:
   actions: read
 
 jobs:
+  trusted-vsi-paired:
+    name: Trusted VSI paired-source API (not release artifacts)
+    if: |
+      !startsWith(github.ref, 'refs/tags/castlabs-v') &&
+      (github.event_name != 'pull_request' ||
+       github.event.pull_request.author_association == 'COLLABORATOR' ||
+       github.event.pull_request.author_association == 'MEMBER' ||
+       github.event.pull_request.user.login == 'dependabot[bot]' ||
+       contains(github.event.pull_request.labels.*.name, 'safe to test'))
+    uses: ./.github/workflows/trusted-vsi-paired.yml
+
   read-version:
     name: Read C2PA version
     if: ${{ !startsWith(github.ref, 'refs/tags/castlabs-v') }}
@@ -144,7 +155,10 @@ jobs:
           python3 -c "from c2pa import C2paError; print('C2paError imported successfully')"
 
       - name: Run tests
-        run: python3 ./tests/test_unit_tests.py
+        run: python3 -m pytest tests/test_unit_tests.py tests/test_sign_ladder.py
+
+      - name: Test disabled trusted API against upstream native (not ABI qualification)
+        run: python3 -m pytest -q tests/test_trusted_vsi_api.py -k "not paired"
 
   tests-windows:
     name: Unit tests for developer setup (Windows)
@@ -230,7 +244,10 @@ jobs:
           python -c "from c2pa import C2paError; print('C2paError imported successfully')"
 
       - name: Run tests
-        run: python .\tests\test_unit_tests.py
+        run: python -m pytest .\tests\test_unit_tests.py .\tests\test_sign_ladder.py
+
+      - name: Test disabled trusted API against upstream native (not ABI qualification)
+        run: python -m pytest -q tests/test_trusted_vsi_api.py -k "not paired"
 
   build-linux-wheel:
     name: Build Linux wheel
@@ -315,7 +332,7 @@ jobs:
       - name: Run tests with pytest (venv)
         run: |
           source venv/bin/activate
-          venv/bin/pytest tests/test_unit_tests.py -v
+          venv/bin/pytest tests/test_unit_tests.py tests/test_sign_ladder.py -v
 
   build-windows-wheel:
     name: Build Windows wheel
@@ -407,7 +424,7 @@ jobs:
       - name: Run tests with pytest (venv)
         run: |
           .\venv\Scripts\activate
-          .\venv\Scripts\pytest .\tests\test_unit_tests.py -v
+          .\venv\Scripts\pytest .\tests\test_unit_tests.py .\tests\test_sign_ladder.py -v
 
   build-macos-wheel:
     name: Build macOS wheels
@@ -496,7 +513,7 @@ jobs:
       - name: Run tests with pytest (venv)
         run: |
           source venv/bin/activate
-          venv/bin/pytest tests/test_unit_tests.py -v
+          venv/bin/pytest tests/test_unit_tests.py tests/test_sign_ladder.py -v
 
   sdist:
     runs-on: ubuntu-latest

.github/workflows/castlabs-vsi-release.yml

@@ -7,9 +7,14 @@ on:
   workflow_dispatch:
     inputs:
       source_sha:
-        description: Full feat/live-video-vsi branch-tip SHA to release
+        description: Full Python SHA (feat/live-video-vsi tip for dev5; paired source for trusted_vsi_only)
         required: true
         type: string
+      trusted_vsi_only:
+        description: Only non-publishing paired-source trusted API tests; bypass all dev5 jobs
+        required: false
+        type: boolean
+        default: false
 
 concurrency:
   group: castlabs-vsi-release-0.37.8.dev5
@@ -24,7 +29,14 @@ env:
   PYTHONHASHSEED: "0"
 
 jobs:
+  trusted-vsi-paired:
+    if: github.event_name == 'workflow_dispatch' && inputs.trusted_vsi_only
+    uses: ./.github/workflows/trusted-vsi-paired.yml
+    with:
+      python-ref: ${{ inputs.source_sha }}
+
   prepare:
+    if: ${{ !inputs.trusted_vsi_only }}
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     outputs:

.github/workflows/test-c2pa-rs-source-build.yml

@@ -0,0 +1,208 @@
+name: Test against c2pa-rs built from source
+
+# Validates c2pa-python against a c2pa-rs git ref that has no published
+# release artifacts (e.g. a release candidate tag), by building the native
+# library from source instead of downloading a prebuilt one.
+#
+# This is the reusable tool for RC preflights: commit the target ref to
+# c2pa-rs-preflight-ref.txt on a PR branch. Its mere presence is what opts
+# the PR in, so this reruns automatically on every push to that PR -- same
+# as any other check -- instead of you having to remember to re-dispatch by
+# hand while iterating on fixes. Delete the file again once the PR is done
+# with the RC (or once c2pa-rs ships a real release and you bump
+# c2pa-native-version.txt through the normal process instead).
+#
+# Deliberately no workflow_dispatch trigger here: dispatching this workflow
+# against the default branch would run in a context with write access to
+# the default branch's Actions cache scope, while checking out and
+# executing an arbitrary, unvalidated c2pa-rs ref -- exactly the cache
+# poisoning pattern CodeQL's actions/cache-poisoning/poisonable-step query
+# looks for. A same-repo pull_request only ever gets write access to its
+# own branch's cache scope, so that path doesn't have the same exposure.
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - labeled
+
+permissions:
+  contents: read
+
+jobs:
+  resolve-ref:
+    name: Resolve c2pa-rs ref to test
+    runs-on: ubuntu-latest
+    outputs:
+      ref: ${{ steps.resolve.outputs.ref }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Resolve ref
+        id: resolve
+        run: |
+          if [ -f c2pa-rs-preflight-ref.txt ]; then
+            ref="$(tr -d '\r\n' < c2pa-rs-preflight-ref.txt)"
+          else
+            ref=""
+          fi
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+          if [ -z "$ref" ]; then
+            echo "No c2pa-rs-preflight-ref.txt in this tree -- nothing to test, downstream jobs will skip."
+          else
+            echo "Testing against c2pa-rs ref: $ref"
+          fi
+
+  tests-unix:
+    name: Unit tests (Unix, ${{ matrix.os }})
+    needs: resolve-ref
+    if: |
+      needs.resolve-ref.outputs.ref != '' && (
+        github.event_name != 'pull_request' ||
+        github.event.pull_request.author_association == 'COLLABORATOR' ||
+        github.event.pull_request.author_association == 'MEMBER' ||
+        github.event.pull_request.user.login == 'dependabot[bot]' ||
+        contains(github.event.pull_request.labels.*.name, 'safe to test')
+      )
+
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ macos-latest, ubuntu-latest, ubuntu-24.04-arm ]
+
+    steps:
+      - name: Checkout c2pa-python
+        uses: actions/checkout@v4
+        with:
+          path: c2pa-python
+
+      - name: Checkout c2pa-rs (${{ needs.resolve-ref.outputs.ref }})
+        uses: actions/checkout@v4
+        with:
+          repository: contentauth/c2pa-rs
+          ref: ${{ needs.resolve-ref.outputs.ref }}
+          path: c2pa-rs
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          # No pip cache here: this job checks out and builds an arbitrary,
+          # not-necessarily-reviewed c2pa-rs ref, and CodeQL flags caching in
+          # that context as a cache-poisoning vector into the default branch.
+
+      - name: Install project dependencies
+        working-directory: c2pa-python
+        run: |
+          python -m pip install -r requirements.txt
+          python -m pip install -r requirements-dev.txt
+
+      - name: Build native library from c2pa-rs source
+        working-directory: c2pa-python
+        env:
+          C2PA_RS_PATH: ${{ github.workspace }}/c2pa-rs
+          # Build for the runner's own arch rather than the universal2 macOS
+          # default: it's what a local `pip install -e .` picks up anyway,
+          # and skips the slow cross-compiled second-arch OpenSSL build.
+          C2PA_LIBS_PLATFORM: ${{ matrix.os == 'macos-latest' && 'aarch64-apple-darwin' || (matrix.os == 'ubuntu-24.04-arm' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu') }}
+        run: python scripts/build_local_artifacts.py --clean
+
+      - name: Install package in development mode
+        working-directory: c2pa-python
+        run: |
+          pip uninstall -y c2pa
+          pip install -e .
+
+      - name: Verify installation
+        working-directory: c2pa-python
+        run: python -c "from c2pa import C2paError; print('C2paError imported successfully')"
+
+      - name: Run tests
+        working-directory: c2pa-python
+        env:
+          C2PA_PREFLIGHT_RUN: "1"
+        run: python -m pytest tests/test_unit_tests.py tests/test_sign_ladder.py
+
+  tests-windows:
+    name: Unit tests (Windows, ${{ matrix.runs-on }})
+    needs: resolve-ref
+    if: |
+      needs.resolve-ref.outputs.ref != '' && (
+        github.event_name != 'pull_request' ||
+        github.event.pull_request.author_association == 'COLLABORATOR' ||
+        github.event.pull_request.author_association == 'MEMBER' ||
+        github.event.pull_request.user.login == 'dependabot[bot]' ||
+        contains(github.event.pull_request.labels.*.name, 'safe to test')
+      )
+
+    runs-on: ${{ matrix.runs-on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runs-on: windows-latest
+            python-version: "3.10"
+          - runs-on: windows-11-arm
+            python-version: "3.11"  # win-arm runner needs 3.11 at least
+
+    steps:
+      - name: Checkout c2pa-python
+        uses: actions/checkout@v4
+        with:
+          path: c2pa-python
+
+      - name: Checkout c2pa-rs (${{ needs.resolve-ref.outputs.ref }})
+        uses: actions/checkout@v4
+        with:
+          repository: contentauth/c2pa-rs
+          ref: ${{ needs.resolve-ref.outputs.ref }}
+          path: c2pa-rs
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          # No pip cache here: this job checks out and builds an arbitrary,
+          # not-necessarily-reviewed c2pa-rs ref, and CodeQL flags caching in
+          # that context as a cache-poisoning vector into the default branch.
+
+      - name: Install ARM64 OpenSSL via vcpkg (Windows ARM64)
+        if: matrix.runs-on == 'windows-11-arm'
+        shell: pwsh
+        run: |
+          # Pre-installed OpenSSL on runner fails build.
+          # Static OpenSSL to avoid runtime DLL load complexities.
+          & "$env:VCPKG_INSTALLATION_ROOT\vcpkg.exe" install openssl:arm64-windows-static-md
+          $vcpkgRoot = "$env:VCPKG_INSTALLATION_ROOT\installed\arm64-windows-static-md"
+          echo "OPENSSL_DIR=$vcpkgRoot" >> $env:GITHUB_ENV
+          echo "OPENSSL_STATIC=1" >> $env:GITHUB_ENV
+
+      - name: Install project dependencies
+        working-directory: c2pa-python
+        run: |
+          python -m pip install -r requirements.txt
+          python -m pip install -r requirements-dev.txt
+
+      - name: Build native library from c2pa-rs source
+        working-directory: c2pa-python
+        env:
+          C2PA_RS_PATH: ${{ github.workspace }}\c2pa-rs
+        run: python scripts\build_local_artifacts.py --clean
+
+      - name: Install package in development mode
+        working-directory: c2pa-python
+        run: |
+          pip uninstall -y c2pa
+          pip install -e .
+
+      - name: Verify installation
+        working-directory: c2pa-python
+        run: python -c "from c2pa import C2paError; print('C2paError imported successfully')"
+
+      - name: Run tests
+        working-directory: c2pa-python
+        env:
+          C2PA_PREFLIGHT_RUN: "1"
+        run: python -m pytest .\tests\test_unit_tests.py .\tests\test_sign_ladder.py