# 校验 updater 验签密钥配对(终版): 比对 keyid(KEYNUM 8字节) —— minisign 格式对齐
# conf.pubkey blob(42B):  SIGALG"Ed"[0..2] + KEYNUM[2..10] + PUBKEY[10..42]
# 私钥文件 blob(116B):    SIGALG"Rs"[0..2] + KDFALG[2..4] + CKSUM[4..12] + SALT[12..28] + OPS[28..36] + MEM[36..44] + KEYNUM[44..52] + SIG[52..116]
$confPath = "E:\wk-lab\devflow\src-tauri\tauri.conf.json"
$keyPath  = Join-Path $env:USERPROFILE ".tauri\devflow.key"

# 1. conf 侧: 提取 pubkey → 解码 → 取 KEYNUM
$raw = Get-Content $confPath -Raw
if ($raw -match '"pubkey"\s*:\s*"([A-Za-z0-9+/=]{40,400})"') { $confPubB64 = $Matches[1] } else { Write-Host "CONF_PUBKEY_NOT_FOUND"; exit 1 }
# conf.pubkey 是 base64(minisign .pub 文件文本)，需二次解码取末行
$confText = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($confPubB64))
$pubLines = @($confText -split "`n" | Where-Object { $_.Trim() -and $_ -notmatch 'comment' } | ForEach-Object { $_.Trim() })
if ($pubLines.Count -lt 1) { Write-Host "CONF_PUB_FORMAT_UNEXPECTED"; exit 1 }
$confBlob   = [Convert]::FromBase64String($pubLines[0])
$confKeynum = ($confBlob[2..9]   | ForEach-Object { $_.ToString("x2") }) -join ""
Write-Host "conf keyid  : $confKeynum  (blob $($confBlob.Length)B)"

# 2. key 侧: 私钥文件 = 注释行 + 1 条 b64 blob(KEYNUM 未加密,明文可读)
if (-not (Test-Path $keyPath)) { Write-Host "KEY_NOT_FOUND: $keyPath"; exit 1 }
$b64Lines = @(Get-Content $keyPath | Where-Object { $_ -and $_ -notmatch 'comment' } | ForEach-Object { $_.Trim() })
if ($b64Lines.Count -lt 1) { Write-Host "KEY_FORMAT_UNEXPECTED"; exit 1 }
$secBlob   = [Convert]::FromBase64String($b64Lines[0])
$secKeynum = ($secBlob[44..51] | ForEach-Object { $_.ToString("x2") }) -join ""
Write-Host "key  keyid  : $secKeynum  (blob $($secBlob.Length)B)"

# 3. 配对判定
if ($confKeynum -eq $secKeynum) {
    Write-Host "MATCH - updater 验签密钥配对正确(keyid $confKeynum), B3 安装验签可通过"
    exit 0
} else {
    Write-Host "MISMATCH - tauri.conf.json 的 pubkey 与签名私钥不配对, B3 安装验签将失败!"
    exit 1
}