#!/usr/bin/env php
<?php
/**
 * Sign a release tarball with Ed25519.
 *
 * Usage: php scripts/sign-release.php <tarball-path>
 *
 * Reads the private key from ~/.mv-release-key (base64-encoded).
 * Produces <tarball-path>.sig (raw 64-byte Ed25519 signature).
 */

if ($argc < 2) {
    fwrite(STDERR, "Usage: php scripts/sign-release.php <tarball-path>\n");
    exit(1);
}

$tarballPath = $argv[1];

if (!file_exists($tarballPath)) {
    fwrite(STDERR, "ERROR: File not found: $tarballPath\n");
    exit(1);
}

if (!function_exists('sodium_crypto_sign_detached')) {
    fwrite(STDERR, "ERROR: sodium extension is required.\n");
    exit(1);
}

// Read private key
$keyFile = $_SERVER['HOME'] . '/.mv-release-key';
if (!file_exists($keyFile)) {
    fwrite(STDERR, "ERROR: Private key not found at $keyFile\n");
    fwrite(STDERR, "Run: php scripts/generate-keypair.php\n");
    exit(1);
}

$secretKeyBase64 = trim(file_get_contents($keyFile));
$secretKey = base64_decode($secretKeyBase64, true);
if ($secretKey === false || strlen($secretKey) !== SODIUM_CRYPTO_SIGN_SECRETKEYBYTES) {
    fwrite(STDERR, "ERROR: Invalid private key in $keyFile\n");
    exit(1);
}

// Read tarball
$content = file_get_contents($tarballPath);
if ($content === false) {
    fwrite(STDERR, "ERROR: Could not read $tarballPath\n");
    exit(1);
}

// Sign
$signature = sodium_crypto_sign_detached($content, $secretKey);

// Write signature
$sigPath = $tarballPath . '.sig';
file_put_contents($sigPath, $signature);

echo "Signed: $sigPath (" . strlen($signature) . " bytes)\n";

// Verify as sanity check
$publicKey = sodium_crypto_sign_publickey_from_secretkey($secretKey);
if (sodium_crypto_sign_verify_detached($signature, $content, $publicKey)) {
    echo "Verification: OK\n";
} else {
    fwrite(STDERR, "ERROR: Self-verification failed!\n");
    exit(1);
}
