The Sigsum team is happy to announce an update of the Sigsum C Library (aka sigsum-c or libsigsum), version 1.1.0. See NEWS file, excerpt below, for a summary of changes. Library documentation is included in the package and online at https://git.glasklar.is/sigsum/core/sigsum-c/-/blob/main/doc/sigsum-c.md. The release source code can be downloaded using git clone -b v1.1.0 https://git.glasklar.is/sigsum/core/sigsum-c.git The v1.1.0 tag is signed using the key ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/xZ+v5e435605MS4BYE89PLcgk8DT5PvuoM2oASnuk This is the same release key also published for nisse@glasklarteknik.se at https://www.system-transparency.org/keys/allowed-ST-release-signers. /The Sigsum team NEWS for the sigsum-c 1.1.0 release This is a minor update of the sigsum-c library. The new version is fully compatible with with version 1.0.0 with one minor exception, see below. The shared library name is libsigsum.so.0.1, with unchanged soname libsigsum.so.0. Incompatible change: * The list of of cosignatures in struct sigsum_proof is now sorted by witness key hash. Out of order cosignatures are ignored, making verification of some otherwise valid proofs return failure. The required sorting is taken care of by sigsum_proof_parse, but applications that populate a sigsum_proof by other means must be updated accordingly. New features: * New configure flag --disable-tools, to not build and install the sigsum-c-verify tool. Contributed by Florian Larysch. Improvements: * The returned error message from sigsum_proof_verify now makes a distinction between problems with the log signature and problems with the leaf signature.