# step: hybrid signatures · wai-rs and pq_verify.py
# order: 710
# build: pq
# features: pq_signatures synthesis,pq_signatures
# paths: wai/extensions/pq-signatures.md
# independent: pq trust needs=cryptography verdicts=pq-conformance/vectors.json python3 -I pq-conformance/pq_verify.py pq-conformance
#
# Hybrid signatures (extensions/pq-signatures.md): the reference module's unit tests (its
# ML-DSA-65 against FIPS 204's ACVP vectors — keyGen, deterministic sigGen and sigVer —
# vendored in pq-conformance/acvp and pinned by SHA-256, and the composite against the
# draft's own vector, before anything is built on them), the synthesis reader's hybrid
# records, and tests/pq_signatures.rs (vectors.json regenerates byte for byte, every case
# reaches its verdict, §8 lists exactly the reference's codes, each given); and, in the
# step of every independent verifier above, the
# corpus's second implementation, pq_verify.py, written from the extension's text and
# sharing no code with wai-rs, which verifies ML-DSA-65 from FIPS 204's text in pure
# Python (_mldsa.py), checks every ACVP verification vector and signature and the draft's
# vector, every case, the sizes §9 states and §8's table, requires every mutated case to be
# refused and the corpus to catch it with any one of its checks dropped; run isolated (-I).
# Last, the two give every case the same verdict.
#
# The paths this step brings to the workflow's trigger, and why:
# wai/extensions/pq-signatures.md: tests/pq_signatures.rs requires this extension's §8 to list the
#   codes the reference reports, pq_verify.py reads that table, and the registry's wire
#   identifiers test reads its §2.
set -euo pipefail
(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib pq_sig::)
(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --lib synthesis::pq_tests)
(cd wai-rs && cargo test --no-default-features --features "$WAI_PQ_FEATURES" --test pq_signatures)
python3 -I pq-conformance/pq_verify.py verdicts pq-conformance/vectors.json > "$RUNNER_TEMP/pq-py.tsv"
(cd wai-rs && "$RUNNER_TEMP/wai-bins/pq/wai_pq_vectors" verdicts ../pq-conformance/vectors.json) > "$RUNNER_TEMP/pq-rs.tsv"
diff "$RUNNER_TEMP/pq-py.tsv" "$RUNNER_TEMP/pq-rs.tsv"