remote-cmd.sh: https://gist.github.com/eeeps/aa62b2e9b2aeb4070011aeb0721197ef
manifest.json: https://gist.github.com/eeeps/7768715f05e0e426ea1f3098e82b12c3
photographs-of-snowmen-13.jpg: https://o.img.rodeo/photographs-of-snowmen-13.jpg
photographs-of-snowmen-13-optimized.jpg: https://o.img.rodeo/photographs-of-snowmen-13-optimized.jpg
(not gonna include mycerts.pem or mykey.pem 😌)

Running remote-cmd.sh with c2patool 0.7.0 generates photographs-of-snowmen-13-signed.c2pa, and embeds an XMP Provenance field in photographs-of-snowmen-13-signed.jpg with the remote URL, as expected.

Running these same commands on these same files using the latest version of c2patool (0.10.2) puts the following on stdout: https://gist.github.com/eeeps/528a7630f3f653e851ea1bf77618f301. Also...

1. The command does not create a .c2pa file.
2. photographs-of-snowmen-13-signed.jpg contains both:
   • an XMP Provenance field with the remote URL (expected)
   • a full embedded manifest (unexpected)

Additionally, running this command outputs a file to disc named xmp/iid/9f21ba1e-f4c9-48b1-b355-70a7508a1c08 which is a JPEG, that mysteriously weighs 32KB more than the input JPEG.

Seems related to #830