# 生成自签名代码签名证书 - 降低360敏感度
# 使用方法: 以管理员身份运行 PowerShell, 执行 .\generate_cert.ps1

param(
    [string]$CertPassword = "WindowMsgBot2026",
    [string]$CertSubject = "CN=WindowMsgBot, O=WindowMsgBot Development, OU=Software Development, E=dev@windowmsgbot.local",
    [int]$ValidYears = 10
)

Write-Host "=== 生成自签名代码签名证书 ===" -ForegroundColor Cyan

# 1. 生成证书
Write-Host "1. 生成自签名证书..." -ForegroundColor Yellow
# 使用更完整的证书参数，增加可信度
$cert = New-SelfSignedCertificate `
    -Subject $CertSubject `
    -Type CodeSigningCert `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -NotAfter (Get-Date).AddYears($ValidYears) `
    -KeyAlgorithm RSA `
    -KeyLength 2048 `
    -HashAlgorithm SHA256 `
    -FriendlyName "WindowMsgBot Code Signing Certificate" `
    -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3") `
    -KeyUsage DigitalSignature, KeyEncipherment `
    -KeyProtection None

if (-not $cert) {
    Write-Error "证书生成失败!"
    exit 1
}

Write-Host "   证书指纹: $($cert.Thumbprint)" -ForegroundColor Green

# 2. 导出PFX文件
Write-Host "2. 导出PFX文件..." -ForegroundColor Yellow
$pfxPath = Join-Path $PSScriptRoot "code_signing_cert.pfx"
$password = ConvertTo-SecureString -String $CertPassword -Force -AsPlainText

Export-PfxCertificate `
    -Cert $cert `
    -FilePath $pfxPath `
    -Password $password

Write-Host "   PFX已保存: $pfxPath" -ForegroundColor Green

# 3. 导出CER文件（公钥）
Write-Host "3. 导出CER公钥文件..." -ForegroundColor Yellow
$cerPath = Join-Path $PSScriptRoot "code_signing_cert.cer"
Export-Certificate `
    -Cert $cert `
    -FilePath $cerPath

Write-Host "   CER已保存: $cerPath" -ForegroundColor Green

# 4. 安装到受信任的根证书颁发机构
Write-Host "4. 安装到受信任的根证书颁发机构..." -ForegroundColor Yellow
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store(
    "Root", "LocalMachine")
$store.Open("ReadWrite")
$store.Add($cert)
$store.Close()

Write-Host "   证书已安装到受信任的根证书存储" -ForegroundColor Green

# 5. 验证安装
Write-Host "5. 验证证书安装..." -ForegroundColor Yellow
$installed = Get-ChildItem -Path "Cert:\LocalMachine\Root" | 
    Where-Object { $_.Thumbprint -eq $cert.Thumbprint }

if ($installed) {
    Write-Host "   ? 证书已成功安装到受信任存储" -ForegroundColor Green
} else {
    Write-Host "   ? 证书可能未安装到受信任存储" -ForegroundColor Yellow
}

# 6. 输出证书信息
Write-Host "`n=== 证书信息 ===" -ForegroundColor Cyan
Write-Host "主题: $($cert.Subject)"
Write-Host "指纹: $($cert.Thumbprint)"
Write-Host "有效期: $($cert.NotBefore) 至 $($cert.NotAfter)"
Write-Host "用途: $($cert.EnhancedKeyUsageList.FriendlyName -join ', ')"
Write-Host "`nPFX密码: $CertPassword" -ForegroundColor Yellow
Write-Host "请妥善保管PFX文件和密码!" -ForegroundColor Red

# 7. 创建证书信息文件
Write-Host "7. 创建证书信息文件..." -ForegroundColor Yellow
$infoPath = Join-Path $PSScriptRoot "cert_info.txt"
@"
证书信息
========
主题: $($cert.Subject)
指纹: $($cert.Thumbprint)
有效期: $($cert.NotBefore) 至 $($cert.NotAfter)
PFX文件: code_signing_cert.pfx
CER文件: code_signing_cert.cer
PFX密码: $CertPassword

使用说明
========
1. PFX文件用于signtool签名
2. CER文件可分发给其他人验证签名
3. 证书已安装到本机受信任存储
"@ | Out-File -FilePath $infoPath -Encoding UTF8

Write-Host "   证书信息已保存: $infoPath" -ForegroundColor Green

Write-Host "`n=== 完成 ===" -ForegroundColor Cyan
Write-Host "下一步: 使用 sign.bat 脚本签名exe文件" -ForegroundColor Yellow