proc usage { error } {
  if {[string length $error] > 0} then {puts stdout $error}

  puts stdout "usage:\
[file tail [getShellExecutableName]]\
[file tail [info script]] <fileName> \[vendor\] \[embed\]\
\[duration\] \[entityType\] \[encoding\] \[publicKeyFile\]\
\[privateKeyFile\] \[importFirst\] \[quantity\] \[id\]\
\[timeStamp\]"

  #
  # NOTE: Indicate to the caller, if any, that we have failed.
  #
  exit 1
}

proc maybeInvokeHook { type phase } {
  set name [appendArgs $type _hook]

  if {[llength [info commands $name]] > 0} then {
    if {[catch {$name $phase} result] == 0} then {
      if {[string length $result] == 0} then {set result <none>}
      emitNotice [appendArgs $name " hook ok: " $result]
    } else {
      if {[string length $result] == 0} then {set result <none>}
      emitWarning [appendArgs $name " hook error: " $result]
    }
  }
}

proc emitNotice { message } {
  set message [string trim $message]
  catch {host result Ok [appendArgs $message \n]}
}

proc emitWarning { message } {
  emitNotice $message
  set message [string trim $message]
  catch {tclLog $message}
}

proc emitError { message } {
  emitWarning $message
  set message [string trim $message]
  error $message
}

proc maybeForceHashAlgorithm { certificate keyPair } {
  #
  # HACK: Some key pair types, e.g. DSA v1, require hard-coded
  #       hash algorithms, e.g. SHA1.  Do that now, if needed.
  #
  if {[isNonNullObjectHandle $keyPair] && \

      puts stdout [appendArgs \
          "removed embedded certificate from file \"" $fileName \"]
    }
  }
}

if {[llength $argv] >= 1 && [llength $argv] <= 12} then {
  #
  # NOTE: This tool requires Eagle.
  #
  package require Eagle

  #
  # NOTE: Needed for the [getTemporaryPath] script procedure.

  #
  if {[llength $argv] >= 10} then {
    set quantity [lindex $argv 9]
  } else {
    set quantity -1; # NOTE: Unlimited.
  }

  #
  # NOTE: Do we want to manually override the unique Id?
  #
  if {[llength $argv] >= 11} then {
    set id [lindex $argv 10]
  } else {
    set id ""; # NOTE: Guid.NewGuid (?)
  }

  #
  # NOTE: Do we want to manually override the timestamp?
  #
  if {[llength $argv] >= 12} then {
    set timeStamp [object invoke \
        -create -alias DateTime ParseExact \
        [lindex $argv 11] yyyy-MM-ddTHH:mm:ss.fffffffK \
        null {AdjustToUniversal AssumeUniversal}]

    set timeStamp [object invoke \
        -create DateTime SpecifyKind $timeStamp Utc]
  } else {
    set timeStamp ""; # NOTE: DateTime.UtcNow (?)
  }

  #
  # NOTE: If the configuration file exists, load it now.
  #
  set configFileName [file join $path sign.settings.eagle]
  if {[file exists $configFileName]} then {source $configFileName}

  #

  } else {
    set shouldEmbed false
  }

  #
  # HOOK: After all arguments have been parsed and processed.
  #
  maybeInvokeHook certificate phase0

  #
  # NOTE: The existing embedded certificate, if any, must be
  #       removed prior to signing the (script?) file.
  #
  if {$shouldEmbed && \
      ![info exists no(removeEmbeddedCertificate)]} then {

    #
    set certificate [certificate import $fileName]
    maybeForceHashAlgorithm $certificate $privateKey

    #
    # HOOK: Post-certificate object creation (import).
    #
    maybeInvokeHook certificate phase1

    #
    # NOTE: Attempt to re-sign the license certificate file.  Skip
    #       setting the Id as it should already be set correctly.
    #
    if {[certificate sign -encoding $encoding \
            -settimestamp -maybesettimestamp $timeStamp \
            -setkey $certificate $privateKey] ne "SignedOk"} then {
      emitError [appendArgs \
          "failed to create updated signature for " $fileType \
          " \"" $fileName \"]
    }

    #
    # NOTE: Attempt to re-verify the license certificate file.
    #
    if {[certificate verify -encoding $encoding $certificate \
            $privateKey] ne "VerifiedOk"} then {
      emitError [appendArgs \
          "failed to verify signature for " $fileType " \"" $fileName \"]
    }
  } else {
    #
    # NOTE: Set the file type for error messages.
    #
    if {[isKeyRingFile $fileName]} then {

    }

    maybeForceHashAlgorithm $certificate $privateKey

    #
    # HOOK: Post-certificate object creation (create).
    #
    maybeInvokeHook certificate phase1

    #
    # NOTE: If the certificate vendor is available, set it.
    #
    if {[string length $vendor] > 0} then {
      $certificate Vendor $vendor
    }

      #       some point, be seen by the script policy callback.
      #
      $certificate EntityValue [readEntityValue $fileName]

      #
      # HOOK: Post-certificate property setup (embedded).
      #
      maybeInvokeHook certificate phase2

      #
      # NOTE: Attempt to sign the embedded file certificate and place
      #       the Id, timestamp, public key token, and signature bytes
      #       into the certificate we created above.
      #
      if {$importFirst} then {
        if {[certificate sign -encoding $encoding \
                -setkey -hashflags {+Basic Embedded} $certificate \
                $privateKey] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create updated embedded signature for " \
              $fileType " \"" $fileName \"]
        }
      } else {
        if {[certificate sign -encoding $encoding \
                -setid -maybesetid $id -settimestamp \
                -maybesettimestamp $timeStamp -setkey \
                -hashflags {+Basic Embedded} $certificate \
                $privateKey] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create embedded signature for " $fileType \
              " \"" $fileName \"]
        }
      }

      #
      # NOTE: Sanity check that the embedded file certificate we just
      #       created validates properly.
      #
      if {[certificate verify -encoding $encoding \
              -hashflags {+Basic Embedded} $certificate \
              $publicKey] ne "VerifiedOk"} then {
        emitError [appendArgs \
            "failed to verify embedded signature for " $fileType \
            " \"" $fileName \"]
      }
    } else {
      #
      # HOOK: Post-certificate property setup (non-embedded).
      #
      maybeInvokeHook certificate phase2

      #
      # NOTE: Attempt to sign the data file and place the Id, timestamp,
      #       public key token, and signature bytes into the blank
      #       certificate we created above.
      #
      if {$importFirst} then {
        if {[certificate signfile -encoding $encoding \
                -setkey $certificate $privateKey \
                $fileName] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create updated signature for " $fileType \
              " \"" $fileName \"]
        }
      } else {
        if {[certificate signfile -encoding $encoding \
                -setid -maybesetid $id -settimestamp \
                -maybesettimestamp $timeStamp -setkey \
                $certificate $privateKey \
                $fileName] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create signature for " $fileType \
              " \"" $fileName \"]
        }
      }

      #
      # NOTE: Sanity check that the data file certificate we just
      #       created validates properly.
      #
      if {[certificate verifyfile -encoding $encoding \
              $certificate $publicKey $fileName] ne "VerifiedOk"} then {
        emitError [appendArgs \
            "failed to verify signature for " $fileType \
            " \"" $fileName \"]
      }
    }
  }

  #

  catch {file delete -force $certificateFile}

  #
  # NOTE: Export the data file certificate to disk.
  #
  if {[certificate export $certificate $certificateFile] \
          ne "ExportedOk"} then {
    emitError [appendArgs \
        "failed to export signature for " $fileType " \"" $fileName \"]
  }

  #
  # NOTE: Add the standard XML comment to the file.
  #
  if {[certificate warning -type Script $certificateFile] \
          ne "WarningOk"} then {
    emitError [appendArgs \
        "failed to add warning for " $fileType " \"" $fileName \"]
  }

  #
  # HACK: Read the certificate file data into memory, fix the
  #       formatting how we want it, and then re-write the modified
  #       data back out to the same certificate file.

    puts stdout [appendArgs \
        "added embedded certificate to " $fileType " \"" $fileName \"]
  }

  #
  # HOOK: Script completion.
  #
  maybeInvokeHook certificate phase3

  #
  # NOTE: Cleanup the external embedded certificate file, if any.
  #
  if {$shouldEmbed} then {
    catch {file delete -force $certificateFile}
  }