fix: sidecar and remote URL modes for fragmented BMFF signing

[santi-ferreiro]

Summary

Fixes three bugs in the fragmented BMFF (DASH/VOD) signing pipeline exposed when using the fragment subcommand with --sidecar or --remote:

• --sidecar mode was silently ignored: save_to_bmff_fragmented always embedded the JUMBF in the init segment regardless of the RemoteManifest mode on the claim, and returned Ok(()), discarding the bytes. No .c2pa sidecar file was ever written.
• --remote <url> mode was silently ignored for the same reason. The XMP reference that points verifiers to the remote manifest was never embedded in the init segment, and no .c2pa file was written for upload.
• verify_fragmented in the CLI stopped at the first validation failure, hiding any subsequent errors.

Closes contentauth/c2pa-rs#1952

Changes

sdk/src/store.rs

• save_to_bmff_fragmented now returns Result<Vec<u8>> (the signed JUMBF bytes) instead of Result<()>. Reads the RemoteManifest mode from the provenance claim before any mutable borrow and branches:
  • NoRemote / EmbedWithRemote: embeds JUMBF in the init segment via finish_save as before.
  • SideCar / Remote: patches the signature directly into the in-memory JUMBF bytes, restores the clean init segment from the source path (no JUMBF embedded), and embeds the XMP URL for Remote mode.
• start_save_bmff_fragmented accepts a new remote_url: Option<&str> parameter and embeds the XMP reference into the init segment before inithash is computed, so the XMP bytes are covered by the BMFF Merkle hash.
• Simplifies the dynamic-assertions branch: removes the nested match pc.remote_manifest() that silently skipped SideCar/Remote modes; uses the pre-computed embed_jumbf flag instead.

sdk/src/builder.rs

• sign_fragmented_files return type changed from Result<()> to Result<Vec<u8>> to propagate the signed JUMBF bytes from the store to the caller.

cli/src/main.rs

• sign_fragmented now accepts sidecar: bool and remote_url: Option<&str>. Captures the JUMBF Vec<u8> from sign_fragmented_files and writes it as <stem>.c2pa next to the signed init segment when either flag is active. Prints an upload reminder when --remote is used.
• Snapshots args.sidecar / args.remote before they are consumed by the builder setup and threads them through to sign_fragmented.
• verify_fragmented now logs all validation failures instead of stopping at the first.

sdk/examples/fragmented_bmff.rs

• Updated call site to handle the new Result<Vec<u8>> return type from sign_fragmented_files.

Test plan

cargo test --features="file_io" -p c2pa
cargo clippy --features="file_io" --all-targets -- -D warnings

Manual end-to-end

Requires an init segment (BigBuckBunny_2s_init.mp4) and fragment files (*.m4s) with a manifest.json.

Plain embed (unchanged behaviour)

c2patool input/BigBuckBunny_2s_init.mp4 \
  --manifest manifest.json \
  --output out/embed \
  fragment --fragments_glob "*.m4s"

Sidecar — JUMBF written to .c2pa, init segment kept clean

c2patool input/BigBuckBunny_2s_init.mp4 \
  --manifest manifest.json \
  --output out/sidecar \
  --sidecar \
  fragment --fragments_glob "*.m4s"

Remote — JUMBF + XMP URL embedded in init, .c2pa written for upload

c2patool input/BigBuckBunny_2s_init.mp4 \
  --manifest manifest.json \
  --output out/remote \
  --remote "https://example.com/manifests/init.c2pa" \
  fragment --fragments_glob "*.m4s"

Verify (all modes)

c2patool out/embed/input/BigBuckBunny_2s_init.mp4 \
  fragment --fragments_glob "*.m4s"

Mode	Init size	Sidecar	Notes
Plain embed	15,238 B	—	JUMBF in init, no XMP
--sidecar	879 B	14,314 B .c2pa	Clean init, JUMBF in sidecar
--remote <url>	15,940 B	14,314 B .c2pa	JUMBF + XMP in init, sidecar for upload