fix: use c2pa-rs 0.91.7 and patched Python TLS roots

Select the patched native SDK for release builds and require certifi 2026.10.19 for both runtime tooling and artifact downloads. Document independent trust stores and keep contributor setup on the selected release.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: scouten-adobe

README.md

@@ -46,6 +46,24 @@ To use the module in Python code, import the module like this:
 import c2pa
 ```
 
+### TLS trust stores
+
+Release builds select c2pa-rs `c2pa-v0.91.7` through
+`c2pa-native-version.txt`. Rebuild or upgrade installed wheels to update the
+bundled native library; updating Python dependencies alone does not update it.
+Local source builds and externally supplied libraries must also use patched
+c2pa-rs dependencies.
+
+Python artifact downloads use Requests and require `certifi>=2026.10.19`, whose
+CA bundle removes the affected emSign ECC Root CA - G3. This is separate from
+the native SDK's TLS verification. Custom bundles (including `REQUESTS_CA_BUNDLE`
+or `CURL_CA_BUNDLE` overrides), Python/OpenSSL default stores used by
+`urllib.request` in `examples/read.py`, and installer/build tools need their own
+updates. Keep the operating system, Python runtime, and packaging tools current,
+and verify custom stores against the
+[eMudhra incident's affected chains](https://emudhra.we-have-a-problem.com/);
+updating certifi does not patch these other stores.
+
 ## Building from local c2pa-rs sources
 
 ### Using a virtual environment with local builds

c2pa-native-version.txt

@@ -1 +1 @@
-c2pa-v0.91.6
+c2pa-v0.91.7

docs/project-contributions.md

@@ -28,12 +28,15 @@ pip install -r requirements.txt
 pip install -r requirements-dev.txt
 ```
 
-Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the current version you want (for example, as shown below for v0.91.3):
+Download [c2pa-rs library artifacts](https://github.com/contentauth/c2pa-rs/tags) for the release selected in `c2pa-native-version.txt`:
 
 ```bash
-python scripts/download_artifacts.py c2pa-v0.91.3
+make download-native-artifacts
 ```
 
+Without `make`, pass the tag from `c2pa-native-version.txt` directly to
+`python scripts/download_artifacts.py` (currently `c2pa-v0.91.7`).
+
 Install the package in development mode:
 
 ```bash

pyproject.toml

@@ -24,6 +24,7 @@ urls = {homepage = "https://contentauthenticity.org", repository = "https://gith
 dependencies = [
     "toml>=0.10.2",
     "cryptography>=41.0.0",
+    "certifi>=2026.10.19",
     "requests>=2.0.0"
 ]
 

requirements-dev.txt

@@ -9,6 +9,7 @@ pytest>=8.1.0
 
 # for downloading the library artifacts
 requests>=2.0.0
+certifi>=2026.10.19
 
 # Code formatting
 autopep8>=2.3.0