fix(identity): report cawg.identity.cbor.invalid instead of failing to load the manifest

[mrappard]

Part of #2884.

Changes in this pull request

When an identity assertion doesn't match the identity CDDL, the whole manifest is rejected. An example is the bundled validation_method/malformed_cbor.jpg, where signer_payload is missing.

In Manifest::from_store, ma.to_assertion::<IdentityAssertion>()? returns the decode error. Reader::from_store then drops the whole manifest and logs one generic failure against it:

{ "code": "assertion.required.missing", "url": "self#jumbf=/c2pa/…", "explanation": "Failed to load manifest" }

No cawg.identity.cbor.invalid is reported, and none of the manifest's other assertions are available.

CAWG Identity Assertion 1.3 §7.1 step 1 says to confirm the assertion matches the identity CDDL, and to report cawg.identity.cbor.invalid if it doesn't. That code is scoped to the identity assertion, like the other §7.1 failures.

Fix: if decoding fails:

• log cawg.identity.cbor.invalid against the identity assertion's URI, with the same description and error as IdentityAssertion::from_manifest uses
• keep the undecoded assertion in the manifest
• continue

Tests: malformed_identity_assertion_reports_cbor_invalid reads malformed_cbor.jpg and checks three things:

• the active manifest loads
• cawg.identity.cbor.invalid is reported with a URL ending in /c2pa.assertions/cawg.identity
• assertion.required.missing isn't reported

It fails without the fix, and passes with OpenSSL and with rust_native_crypto. cargo test -p c2pa --lib --features file_io passes, and Clippy is clean.

Conformance results

Found with a CAWG identity assertion conformance suite I'm building; it's not public yet. Its cbor_invalid case (the bundled malformed_cbor.jpg) now passes.

Checklist

• This PR represents a single feature, fix, or change.
• All applicable changes have been documented.
• Any TO DO items (or similar) have been entered as GitHub issues and the link to that issue has been included in a comment. (No new TODO items.)

🤖 Generated with Claude Code