updates/Sign-Manifest.ps1

[CmdletBinding()]
param(
  [Parameter(Mandatory=$true)][string]$ManifestPath,
  [string]$PrivateKeyXmlPath = ""
)
$ErrorActionPreference = "Stop"

$scriptRoot = Split-Path -Parent $MyInvocation.MyCommand.Path
if ([string]::IsNullOrWhiteSpace($scriptRoot)) { $scriptRoot = "." }

if ([string]::IsNullOrWhiteSpace($PrivateKeyXmlPath)) {
  $PrivateKeyXmlPath = Join-Path $scriptRoot "..\config\update-private-key.xml"
}

if (!(Test-Path $PrivateKeyXmlPath)) {
  throw "Private key file not found: $PrivateKeyXmlPath"
}

$manifestFullPath = (Resolve-Path $ManifestPath).Path
$signaturePath = $manifestFullPath + ".sig"

$bytes = [IO.File]::ReadAllBytes($manifestFullPath)
$rsa = [System.Security.Cryptography.RSA]::Create()
$rsa.FromXmlString((Get-Content $PrivateKeyXmlPath -Raw))
$sig = $rsa.SignData($bytes, [System.Security.Cryptography.HashAlgorithmName]::SHA256, [System.Security.Cryptography.RSASignaturePadding]::Pkcs1)

[IO.File]::WriteAllBytes($signaturePath, $sig)
Write-Host "Manifest signed successfully. Signature saved to: $signaturePath"