Drupal Content Credentials Alpha 2 Tightens C2PA Verification but Leaves Trust Gaps

Version 1.0.0-alpha2 of Drupal's Content Credentials module, released on 24 October 2026, requires a newer PHP verification library after four cases of incorrect trust verdicts were identified in the previous verifier version. The release notes also document fixes for credential loss during image scaling and unsuccessful requests to an external reading service. However, the maintainer warns that the module remains unsuitable for production use.

Content Credentials reads cryptographically signed C2PA provenance records embedded in uploaded images, video and audio. When a credential from a trusted signer indicates AI-generated content, the module creates a pending suggestion through AI Disclosure, which an editor can accept or dismiss. It does not automatically apply disclosure labels or independently establish that the underlying media is authentic.

The pure-PHP verification route now requires provemark/c2pa-verifier 0.8 instead of version 0.7, which contained four identified ways to return an incorrect valid or trusted result. The dependency on provemark/content-credentials 0.19.3 also prevents Composer from installing the older verifier. According to the associated Drupal.org issue, sites using alpha1 can apply the verifier update independently of the module release.

Another fix addresses image fields configured with a maximum resolution. Previously, Drupal could scale an uploaded image during validation, removing its embedded C2PA manifest before the module checked the credentials. The updated module preserves a temporary copy of the signed original for verification and removes that copy after processing. The fix allows verification of the original upload but does not restore the manifest to the scaled image, as documented in the implementation issue.

Requests that receive no response from the external reading service are now retained for retrying for up to 24 hours, rather than being abandoned until the file is replaced. The module can temporarily set aside an unsuccessful request and continue processing other files, while subsequent cron runs handle continued service outages. Explicit error responses from the service do not receive the same retry treatment. The behaviour is documented in the related issue and release notes.

Important verification limitations remain. According to measurements cited in the release notes, the pure-PHP verifier failed to validate 47 of 482 files that the alternative c2pa-rs implementation considered valid. Those files produce no disclosure suggestion through the pure-PHP route. Conversely, the service and ext-c2pa routes, which use c2pa-rs, can still report trusted results for files whose signed hashes do not protect all of the picture or media content. These behaviours arise from the underlying verification libraries and are not resolved by the module update.

The temporary-file mechanism also introduces operational constraints. Cron must run under the appropriate PHP user and have access to the same temporary directory as the upload process. Otherwise, the module can read the scaled file instead of the signed original, producing no suggestion without logging the problem. The release notes also warn that sites sharing a temporary directory can interfere with one another's preserved copies and recommend separate directories.

Content Credentials requires Drupal 11.3 or later, PHP 8.3 or later, and a compatible AI Disclosure installation. The project is not covered by Drupal's security advisory policy, and the maintainer states that it has not been used in production. The release notes explicitly warn against production deployment, leaving development and staging environments as the appropriate places to evaluate alpha2 and its remaining limitations.