@echo off
setlocal enabledelayedexpansion

REM === WindowMsgBot Code Signing Script ===
REM Usage: sign.bat [exe_path]

set "SCRIPT_DIR=%~dp0"
set "PROJECT_DIR=%SCRIPT_DIR%.."
set "CERT_PFX=%SCRIPT_DIR%code_signing_cert.pfx"
set "CERT_PASS=WindowMsgBot2026"
set "OUTPUT_DIR=%PROJECT_DIR%\dist"

if "%~1"=="" (
    if exist "%OUTPUT_DIR%\WindowMsgBot\WindowMsgBot.exe" (
        set "EXE_PATH=%OUTPUT_DIR%\WindowMsgBot\WindowMsgBot.exe"
    ) else (
        set "EXE_PATH=%OUTPUT_DIR%\WindowMsgBot.exe"
    )
) else (
    set "EXE_PATH=%~1"
)

echo === WindowMsgBot Code Signing ===
echo.

if not exist "%EXE_PATH%" (
    echo [ERROR] EXE not found: %EXE_PATH%
    pause
    exit /b 1
)

if not exist "%CERT_PFX%" (
    echo [ERROR] Certificate not found: %CERT_PFX%
    pause
    exit /b 1
)

set "SIGNTOOL="
for %%i in (
    "%ProgramFiles%\Windows Kits\10\bin\x64\signtool.exe"
    "%ProgramFiles(x86)%\Windows Kits\10\bin\x64\signtool.exe"
    "%ProgramFiles%\Windows Kits\10\bin\x86\signtool.exe"
    "%ProgramFiles(x86)%\Windows Kits\10\bin\x86\signtool.exe"
    "%ProgramFiles%\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\signtool.exe"
) do (
    if exist %%i (
        set "SIGNTOOL=%%~i"
        goto :found_sign
    )
)

where signtool.exe >nul 2>&1
if %errorlevel% equ 0 (
    set "SIGNTOOL=signtool.exe"
    goto :found_sign
)

echo [ERROR] signtool.exe not found
echo Install Windows SDK: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
pause
exit /b 1

:found_sign
echo Using signtool: %SIGNTOOL%
echo.

echo 1. Signing exe...
REM 使用更安全的签名选项：指定描述、URL、时间戳服务器
"%SIGNTOOL%" sign /f "%CERT_PFX%" /p "%CERT_PASS%" /d "WindowMsgBot" /du "https://github.com/ypshidifu/windowmsgbot" /tr http://timestamp.digicert.com /td sha256 /fd sha256 /v "%EXE_PATH%"
if %errorlevel% neq 0 (
    echo [ERROR] Signing failed!
    pause
    exit /b 1
)
echo    Signed OK

echo.
echo 2. Verifying signature...
"%SIGNTOOL%" verify /pa "%EXE_PATH%"
if %errorlevel% equ 0 (
    echo    Verification passed
) else (
    echo    Verification failed, signature may still be applied
)

echo.
echo 3. Copying signed exe...
copy "%EXE_PATH%" "%PROJECT_DIR%\WindowMsgBot_signed.exe" >nul
if %errorlevel% equ 0 (
    echo    Copied to: %PROJECT_DIR%\WindowMsgBot_signed.exe
) else (
    echo    Copy failed
)

echo.
echo === Done ===
echo Signed exe: %EXE_PATH%
echo Backup: %PROJECT_DIR%\WindowMsgBot_signed.exe
echo.
pause