[CmdletBinding()]
param(
  [Parameter(Mandatory=$true)][string]$Root,
  [ValidateSet("Warn","Fail")][string]$Mode="Fail"
)
$manifest = Join-Path $Root "manifest\sha256-manifest.json"
if (!(Test-Path $manifest)) {
  if ($Mode -eq "Fail") { throw "Missing sha256 manifest." }
  Write-Warning "Missing sha256 manifest."
  exit 0
}
$data = Get-Content $manifest -Raw | ConvertFrom-Json
$bad = @()
foreach ($entry in $data.files) {
  $p = Join-Path $Root $entry.path
  if (!(Test-Path $p)) { $bad += "missing: $($entry.path)"; continue }
  $h = (Get-FileHash -Algorithm SHA256 $p).Hash.ToLowerInvariant()
  if ($h -ne $entry.sha256.ToLowerInvariant()) { $bad += "hash mismatch: $($entry.path)" }
}
if ($bad.Count -gt 0) {
  $msg = "Integrity check failed:`n" + ($bad -join "`n")
  if ($Mode -eq "Fail") { throw $msg }
  Write-Warning $msg
}