# step: C2PA binding of a stored envelope · wai-rs and c2pa_live_verify.py
# order: 281
# features: c2pa_envelope
# paths: wai/extensions/c2pa-binding.md
# independent: c2pa-envelope live python3 -I live-conformance/c2pa_live_verify.py live-conformance/c2pa-envelope
#
# wai.asset.c2pa (extensions/c2pa-binding.md): the reference module's unit tests (an envelope
# read exactly with nothing after it, the data hash and the WAI assertion read back and every
# other shape refused, the derived manifest identifier, the codes, the reference writer's store
# equal to the corpus's, a store that changes no envelope byte, and the corpus reaching every
# stated outcome and failing a changed one) and tests/c2pa_envelope.rs (every file of the
# committed corpus regenerates byte for byte from its fixed seeds and no other file is there;
# wai-rs gives every vector its stated outcome; every reason of §7 refuses a vector; §7 lists
# exactly the reference's codes with the C2PA code it reports); and, in the step of every
# independent verifier above, the corpus's second implementation, c2pa_live_verify.py, written
# from the extension's text and sharing no code with wai-rs, which reads the envelopes, CBOR,
# JUMBF, COSE and X.509 DER itself, verifies every signature with WAI's strict Ed25519 rule and
# every receipt with BLAKE3 from claim-conformance, reads the extension's reason table, requires
# every mutated copy of a good vector to be refused, and drops each of its own checks in turn;
# standard library only, run isolated (-I).
#
# The paths this step brings to the workflow's trigger, and why:
# wai/extensions/c2pa-binding.md: tests/c2pa_envelope.rs requires this extension's §7 to list
#   the codes and the C2PA codes the reference reports, and c2pa_live_verify.py reads that table.
set -euo pipefail
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib c2pa_envelope::)
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test c2pa_envelope)