# step: live provenance · wai-rs and c2pa_live_verify.py
# order: 280
# features: live_provenance
# paths: wai/extensions/live-provenance.md
# independent: live-provenance live python3 -I live-conformance/c2pa_live_verify.py live-conformance/c2pa-live
#
# wai.live.provenance (extensions/live-provenance.md): the reference module's unit tests
# (boxes, chunks, emsg and the BMFF hash; the JUMBF store; COSE_Sign1 and the OKP key;
# certificates written and read, their profile and chain; identifiers, track renderings,
# dates and the compositor's source type) and tests/live_provenance.rs (every file of the
# committed corpus regenerates byte for byte from its fixed seeds and the packaging
# corpus's AV1 floor, and no other file is there; wai-rs gives every vector its stated
# outcome; every reason of §12 refuses a vector; §12 lists exactly the reference's codes
# with the two C2PA codes it reports); and, in the step of every independent verifier
# above, the corpus's second implementation,
# c2pa_live_verify.py, written from the extension's text and sharing no code with
# wai-rs, which reads CBOR, ISO BMFF, JUMBF, COSE and X.509 DER itself, verifies every
# signature with WAI's strict Ed25519 rule and every receipt with BLAKE3 from
# claim-conformance, reads the extension's reason table, and requires every mutated copy
# of a good vector to be refused; standard library only, run isolated (-I).
#
# The paths this step brings to the workflow's trigger, and why:
# wai/extensions/live-provenance.md: tests/live_provenance.rs requires this extension's §12 to
#   list the codes and the C2PA codes the reference reports, c2pa_live_verify.py reads that table,
#   and the registry's wire identifiers test reads its sections.
set -euo pipefail
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --lib live_provenance::)
(cd wai-rs && cargo test --no-default-features --features "$WAI_FEATURES" --test live_provenance)