Skip to main content

Browser extension・WordPress plugin v0.4.0

Release Information​

⚠️ Breaking Changes and Deprecation​

Breaking change: Support for multiple SRI hashes​

Scope of impact: @originator-profile/sign, @originator-profile/verify, @originator-profile/wordpress

Support for SRI (Subresource Integrity) hashes for multiple pieces of content has been added.

Modified packages:

  • @originator-profile/sign (#152, #165) - Added support for multiple content URLs and SRI hashes
  • @originator-profile/verify (#152, #175, #237) - Implemented validation logic for multiple SRI hashes
  • @originator-profile/model (#175) - Updated validation for ExternalResourceTargetIntegrity
  • @originator-profile/opvc (#175) - Added support for multiple content items to the CLI tool
  • @originator-profile/wordpress (#159) - Added support for multiple SRI hashes to the WordPress plugin

Backward Compatibility:

  • ✅ Existing single SRI hash codes will continue to work.
  • ⚠️ Since the internal implementation of the API has changed, any code relying on specific behavioral details requires verification.

Migration Guide:

When issuing a CA for content where one of multiple resources is displayed—such as an img tag with a srcset attribute—using the CA Server's createOrUpdateCa API, you can specify multiple resources within each ExternalResourceTargetIntegrity. For a concrete example that includes the corresponding HTML markup, please refer to the External Resource Integrity specification page.

// Legacy single content (continues to work)
{
  "type": "ExternalResourceTargetIntegrity",
  // => "integrity": "sha256-Jok2eyBcFs4y...",
  "content": "<Content (image URL or data: URL)>",
}

// New support for multiple content items
{
  "type": "ExternalResourceTargetIntegrity",
  // => "integrity": "sha256-Jok2eyBcFs4y... sha256-FxdxFG6huXtD...",
  "content": ["<Content (image URL or data: URL)>", "<Content (image URL or data: URL)>"]
}

Changed the allowedOrigin property of Content Attestation (CA) to the allowedUrl property​

Date of change: 2025-11-04

Scope of impact: Extensions, WordPress plugins, and CA server (scheduled to be reflected in Dentsu Soken's implementation in mid-January)

In Content Attestation, the property has been changed from allowedOrigin (specifying the Origin) to allowedUrl (specifying the URL pattern).

Migration Method:

// ❌ Deprecated
{ "allowedOrigin": "https://example.com" }

// ✅ Recommended
{ "allowedUrl": "https://example.com/*" }