[CmdletBinding()]
param([string]$WdkRoot)

$ErrorActionPreference = 'Stop'

$projectDir = $PSScriptRoot
$repoRoot = (Resolve-Path (Join-Path $projectDir '..\..')).Path
. (Join-Path $projectDir 'common.ps1')
$wdkRoot = Find-Qa6WdkRoot -ExplicitRoot $WdkRoot -RepoRoot $repoRoot
$wdkVersion = Find-Qa6WdkVersion -WdkRoot $wdkRoot
$buildDir = Join-Path $projectDir 'build\Release\x64'
$packageDir = Join-Path $projectDir 'package'
$certificateDir = Join-Path $projectDir 'cert'
$inf2Cat = Join-Path $wdkRoot "bin\$wdkVersion\x86\Inf2Cat.exe"
$signTool = Find-Qa6SignTool -WdkRoot $wdkRoot -WdkVersion $wdkVersion
$certificateBase = Join-Path $certificateDir 'QemuA6Ude-Test'
$certificateCer = "$certificateBase.cer"
$certificatePfx = "$certificateBase.pfx"
$certificatePasswordText = 'qemu-a6-test'

& (Join-Path $projectDir 'build-driver.ps1') -Configuration Release -WdkRoot $wdkRoot

New-Item -ItemType Directory -Force -Path $packageDir | Out-Null
New-Item -ItemType Directory -Force -Path $certificateDir | Out-Null
Copy-Item -LiteralPath (Join-Path $buildDir 'QemuA6Ude.sys') -Destination $packageDir -Force
Copy-Item -LiteralPath (Join-Path $projectDir 'QemuA6Ude.inf') -Destination $packageDir -Force

$certificatePassword = ConvertTo-SecureString $certificatePasswordText -AsPlainText -Force
$signingCertificate = New-SelfSignedCertificate `
    -Type CodeSigningCert `
    -Subject 'CN=QEMU A6 UDE Test' `
    -CertStoreLocation 'Cert:\CurrentUser\My' `
    -KeyAlgorithm RSA `
    -KeyLength 3072 `
    -HashAlgorithm SHA256 `
    -KeyExportPolicy Exportable `
    -NotAfter (Get-Date).AddYears(10)

try {
    Export-PfxCertificate -Cert $signingCertificate -FilePath $certificatePfx `
        -Password $certificatePassword -Force | Out-Null
    Export-Certificate -Cert $signingCertificate -FilePath $certificateCer `
        -Type CERT -Force | Out-Null
} finally {
    Remove-Item -LiteralPath "Cert:\CurrentUser\My\$($signingCertificate.Thumbprint)" -Force
}

& $signTool sign /fd SHA256 /f $certificatePfx /p $certificatePasswordText (Join-Path $packageDir 'QemuA6Ude.sys')
if ($LASTEXITCODE -ne 0) {
    throw 'Test-signing the SYS file failed.'
}

& $inf2Cat "/driver:$packageDir" '/os:10_X64'
if ($LASTEXITCODE -ne 0) {
    throw 'Generating the driver catalog failed.'
}

& $signTool sign /fd SHA256 /f $certificatePfx /p $certificatePasswordText (Join-Path $packageDir 'QemuA6Ude.cat')
if ($LASTEXITCODE -ne 0) {
    throw 'Test-signing the catalog failed.'
}

Copy-Item -LiteralPath $certificateCer -Destination $packageDir -Force

& $signTool verify /pa /v (Join-Path $packageDir 'QemuA6Ude.cat')
if ($LASTEXITCODE -ne 0) {
    Write-Warning 'The chain is intentionally untrusted until the test certificate is installed.'
}

Write-Host "Driver package ready: $packageDir"
Write-Host "Public certificate: $certificateCer"