[tiptenbrink]

The Azure cases now authorize with Microsoft Entra ID only. The suite does not aim to test a SAS or Shared Key, and the README says so.

• Removes the Azure Shared Key and HMAC-SHA256 vectors. The MD5 and CRC64 vectors stay.
• Where a copy reads its source by URL, x-ms-copy-source-authorization is optional, but only as Bearer <token>. Any other value fails, and so does a query on the source URL.
• Adds azure.append_block_from_url and azure.upload_pages_from_url (flat account only, since HNS has no page blobs).
• Adds copies from another storage account, named by the new call field source_account_url, for every From URL operation. Within one tenant Azure reads the source as the caller, so the source token stays optional.
• Adds copy-other-account: an asynchronous Copy Blob from another account, which Azure answers 401 CannotVerifyCopySource with Entra ID.
• delete-many-version and delete-many-current-version now say which refusal depends on the caller's role.

SigV4 signing:

• Replaces the lone canonical-request vector with 12 SigV4 vectors, each aimed at one canonicalization rule: path encoding and normalization, query sorting, re-encoding, empty and repeated values, header whitespace and repeats, UNSIGNED-PAYLOAD, aws-chunked with a trailer, and a session token.
• Each vector grades the final signature, and checks canonical_request where a signer reports one.
• s3.sign takes a header as a list of values, and a payload_hash.
• Every vector was confirmed against S3. For eight of them, S3 also refused the request signed the mistaken way the vector targets. The AWS C signer passes all 12.

Checksums on reads, blob properties and listings:

• S3 and S3 Express GET and HEAD with checksum_mode, for a stored CRC32 and the default CRC64NVME. A range that does not cover the whole object gets no checksum.
• Azure's MD5 and CRC64 of a range with range_checksum, and its 4 MiB limit. A client may refuse a range one byte over.
• A body that fails its checksum is the new error kind checksum_mismatch, in constructed cases.
• Azure azure.set_metadata and azure.set_properties, each replacing all it sets. Set Blob Properties clears the content properties it does not name.
• s3.list_uploads (ListMultipartUploads) on S3 and S3 Express. On a directory bucket, key-marker takes an earlier page's opaque NextKeyMarker.
• s3.list_directory_buckets in management.json.

All new and changed cases were verified live on both Azure account kinds, S3 and S3 Express. The example borink adapter reports the new Azure cases unsupported until borink-org/object-storage maps them.

Co-Authored-By: Claude Opus 5.5 (1M context) noreply@anthropic.com