Function check_metadata_no_leak 

pub fn check_metadata_no_leak<E, D>(
    enc: E,
    dec: D,
    img: &TestImage,
) -> Conformance
where
    E: EncoderConfig,
    D: DecoderConfig,
    <E::Job as EncodeJob>::Enc: Encoder<Error = E::Error>,

A retention policy never leaks what it discards.

Encodes the image with rich metadata (GPS + thumbnail + camera + copyright + XMP + ICC + CICP) under several policies, decodes, and asserts the output metadata is a subset of what the policy keeps. A subset (not equality) check, so a codec that supports fewer channels still passes — it can drop more, never add back. Discarded ICC/CICP may match a clean encode of the same pixels and policy exactly: that is native/default color rather than retained source metadata. Other discarded fields reappearing are a leak.

What’s directly asserted on the decoded output: ICC, XMP, CICP, HDR (content-light-level / mastering-display), and the EXIF sub-categories the public Exif API can introspect — GPS, thumbnail, rights (copyright/artist), camera/device identity (Exif::has_camera, Make/Model/MakerNote/serials/…) and capture timestamps (Exif::has_datetimes). Device IDs, camera owner, image identity and UTC offsets are checked separately when their descriptive siblings are retained. An emitted EXIF blob that fails to re-parse is also a failure (a mangled blob can hide raw GPS/camera bytes a lenient reader scrapes, and its drops can’t be verified).