proc usage { error } {
  if {[string length $error] > 0} then {puts stdout $error}

  puts stdout "usage:\
[file tail [getShellExecutableName]]\
[file tail [info script]] <fileName> \[vendor\] \[embed\]\
\[duration\] \[entityType\] \[encoding\] \[publicKeyFile\]\
\[privateKeyFile\] \[importFirst\] \[quantity\] \[id\]\
\[timeStamp\]"

  #
  # NOTE: Indicate to the caller, if any, that we have failed.
  #
  exit 1
}

proc maybeInvokeHook { type phase } {
  set name [appendArgs $type _hook]

  if {[llength [info commands $name]] > 0} then {
    if {[catch {$name $phase} result] == 0} then {
      if {[string length $result] == 0} then {set result <none>}
      emitNotice [appendArgs $name " hook ok: " $result]
    } else {
      if {[string length $result] == 0} then {set result <none>}
      emitWarning [appendArgs $name " hook error: " $result]
    }
  }
}

proc emitNotice { message } {
  set message [string trim $message]
  catch {host result Ok [appendArgs $message \n]}
}

proc emitWarning { message } {
  emitNotice $message
  set message [string trim $message]
  catch {tclLog $message}
}

proc emitError { message } {
  emitWarning $message
  set message [string trim $message]
  error $message
}

proc maybeForceHashAlgorithm { certificate keyPair } {
  #
  # HACK: Some key pair types, e.g. DSA v1, require hard-coded
  #       hash algorithms, e.g. SHA1.  Do that now, if needed.
  #
  if {[isNonNullObjectHandle $keyPair] && \

      puts stdout [appendArgs \
          "removed embedded certificate from file \"" $fileName \"]
    }
  }
}

if {[llength $argv] >= 1 && [llength $argv] <= 12} then {
  #
  # NOTE: This tool requires Eagle.
  #
  package require Eagle

  #
  # NOTE: Needed for the [getTemporaryPath] script procedure.

  #
  if {[llength $argv] >= 10} then {
    set quantity [lindex $argv 9]
  } else {
    set quantity -1; # NOTE: Unlimited.
  }

  #
  # NOTE: Do we want to manually override the unique Id?
  #
  if {[llength $argv] >= 11} then {
    set id [lindex $argv 10]
  } else {
    set id ""; # NOTE: Guid.NewGuid (?)
  }

  #
  # NOTE: Do we want to manually override the timestamp?
  #
  if {[llength $argv] >= 12} then {
    set timeStamp [object invoke \
        -create -alias DateTime ParseExact \
        [lindex $argv 11] yyyy-MM-ddTHH:mm:ss.fffffffK \
        null {AdjustToUniversal AssumeUniversal}]

    set timeStamp [object invoke \
        -create DateTime SpecifyKind $timeStamp Utc]
  } else {
    set timeStamp ""; # NOTE: DateTime.UtcNow (?)
  }

  #
  # NOTE: If the configuration file exists, load it now.
  #
  set configFileName [file join $path sign.settings.eagle]
  if {[file exists $configFileName]} then {source $configFileName}

  #

  } else {
    set shouldEmbed false
  }

  #
  # HOOK: After all arguments have been parsed and processed.
  #
  maybeInvokeHook certificate phase0

  #
  # NOTE: The existing embedded certificate, if any, must be
  #       removed prior to signing the (script?) file.
  #
  if {$shouldEmbed && \
      ![info exists no(removeEmbeddedCertificate)]} then {

    #
    set certificate [certificate import $fileName]
    maybeForceHashAlgorithm $certificate $privateKey

    #
    # HOOK: Post-certificate object creation (import).
    #
    maybeInvokeHook certificate phase1

    #
    # NOTE: Attempt to re-sign the license certificate file.  Skip
    #       setting the Id as it should already be set correctly.
    #
    if {[certificate sign -encoding $encoding \
            -settimestamp -maybesettimestamp $timeStamp \
            -setkey $certificate $privateKey] ne "SignedOk"} then {
      emitError [appendArgs \
          "failed to create updated signature for " $fileType \
          " \"" $fileName \"]
    }

    #
    # NOTE: Attempt to re-verify the license certificate file.
    #
    if {[certificate verify -encoding $encoding $certificate \
            $privateKey] ne "VerifiedOk"} then {
      emitError [appendArgs \
          "failed to verify signature for " $fileType " \"" $fileName \"]
    }
  } else {
    #
    # NOTE: Set the file type for error messages.
    #
    if {[isKeyRingFile $fileName]} then {

    }

    maybeForceHashAlgorithm $certificate $privateKey

    #
    # HOOK: Post-certificate object creation (create).
    #
    maybeInvokeHook certificate phase1

    #
    # NOTE: If the certificate vendor is available, set it.
    #
    if {[string length $vendor] > 0} then {
      $certificate Vendor $vendor
    }

      #       some point, be seen by the script policy callback.
      #
      $certificate EntityValue [readEntityValue $fileName]

      #
      # HOOK: Post-certificate property setup (embedded).
      #
      maybeInvokeHook certificate phase2

      #
      # NOTE: Attempt to sign the embedded file certificate and place
      #       the Id, timestamp, public key token, and signature bytes
      #       into the certificate we created above.
      #
      if {$importFirst} then {
        if {[certificate sign -encoding $encoding \
                -setkey -hashflags {+Basic Embedded} $certificate \
                $privateKey] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create updated embedded signature for " \
              $fileType " \"" $fileName \"]
        }
      } else {
        if {[certificate sign -encoding $encoding \
                -setid -maybesetid $id -settimestamp \
                -maybesettimestamp $timeStamp -setkey \
                -hashflags {+Basic Embedded} $certificate \
                $privateKey] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create embedded signature for " $fileType \
              " \"" $fileName \"]
        }
      }

      #
      # NOTE: Sanity check that the embedded file certificate we just
      #       created validates properly.
      #
      if {[certificate verify -encoding $encoding \
              -hashflags {+Basic Embedded} $certificate \
              $publicKey] ne "VerifiedOk"} then {
        emitError [appendArgs \
            "failed to verify embedded signature for " $fileType \
            " \"" $fileName \"]
      }
    } else {
      #
      # HOOK: Post-certificate property setup (non-embedded).
      #
      maybeInvokeHook certificate phase2

      #
      # NOTE: Attempt to sign the data file and place the Id, timestamp,
      #       public key token, and signature bytes into the blank
      #       certificate we created above.
      #
      if {$importFirst} then {
        if {[certificate signfile -encoding $encoding \
                -setkey $certificate $privateKey \
                $fileName] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create updated signature for " $fileType \
              " \"" $fileName \"]
        }
      } else {
        if {[certificate signfile -encoding $encoding \
                -setid -maybesetid $id -settimestamp \
                -maybesettimestamp $timeStamp -setkey \
                $certificate $privateKey \
                $fileName] ne "SignedOk"} then {
          emitError [appendArgs \
              "failed to create signature for " $fileType \
              " \"" $fileName \"]
        }
      }

      #
      # NOTE: Sanity check that the data file certificate we just
      #       created validates properly.
      #
      if {[certificate verifyfile -encoding $encoding \
              $certificate $publicKey $fileName] ne "VerifiedOk"} then {
        emitError [appendArgs \
            "failed to verify signature for " $fileType \
            " \"" $fileName \"]
      }
    }
  }

  #

  catch {file delete -force $certificateFile}

  #
  # NOTE: Export the data file certificate to disk.
  #
  if {[certificate export $certificate $certificateFile] \
          ne "ExportedOk"} then {
    emitError [appendArgs \
        "failed to export signature for " $fileType " \"" $fileName \"]
  }

  #
  # NOTE: Add the standard XML comment to the file.
  #
  if {[certificate warning -type Script $certificateFile] \
          ne "WarningOk"} then {
    emitError [appendArgs \
        "failed to add warning for " $fileType " \"" $fileName \"]
  }

  #
  # HACK: Read the certificate file data into memory, fix the
  #       formatting how we want it, and then re-write the modified
  #       data back out to the same certificate file.

    puts stdout [appendArgs \
        "added embedded certificate to " $fileType " \"" $fileName \"]
  }

  #
  # HOOK: Script completion.
  #
  maybeInvokeHook certificate phase3

  #
  # NOTE: Cleanup the external embedded certificate file, if any.
  #
  if {$shouldEmbed} then {
    catch {file delete -force $certificateFile}
  }

-----BEGIN PGP SIGNATURE-----
Comment: Eagle Package Repository

iQIzBAABCAAdFiEEw8dROIPu3TrtH+QlUCyWr0ldwtkFAmf/sC8ACgkQUCyWr0ld
wtlc5BAAvEmJ2tHq24JdMAhXo8rG6z7LYRI5l/9Zk3Es3pfmz/hX43jN87SPkzw0
CLPLd3u9UC/+4sLZTfKVJ85rTFGWhOPgjSM2DRudzcY4slx9j9V9+W1fKX4a7MRl
mCIwQyiFJIaO63vPZCsMlXSI2x7OpnVajfcXMwIeuI13HuTMnkmij/if8bdA/qqV
GENtUQI0i4Yo0CAsyYYWU4WewuOS0YYqQUY5UqkZ60SVvavA8EO5OZ8T4BqJZ9yE
1QbtAQ8S2kjT/Or6kIWRoDkGf2jPreyo06foz3233pu4kbgUhdg7kc89F7CXUYcP
c/54P5LMYZP1GmzBtuM+6t4UEBb8WDEI10vhVH3l2jNHCkOx9q24ZosNO8T+SbiK
C/lU53Rm2nQkM6Hh+mnYiJ+HQXQVrl0tuXUyO/fvqJpDAVmvPHirpk2xH0lT0r7T
L9varp2LCHORhoj2gpNJZFODkWPK/kCm91tkjK5zrtqsudteK9j6A7urTKjVEhy3
EJwqj6XwU87xHhu83MmkhGPTolrckpbHP86AMHkh9jREyA8tYt7Zn137CBAbxnzG
asw4WZUvYCjcfUS0fYZB4uR29lwYtGmaIvDkuk7kmdL63jJlSdhECSVokylskT3W
ueNtrRZYg47ECAm4eac4Z4Z6yQniTCL5drJ56ZWbW0oiYZM0l8Q=
=v5/Q
-----END PGP SIGNATURE-----

    THE ASSOCIATED SOFTWARE MAY NOT WORK PROPERLY IF THIS FILE IS ALTERED.
-->
<Certificate xmlns="https://eagle.to/2011/harpy"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <Protocol>None</Protocol>
  <Vendor>Mistachkin Systems</Vendor>
  <Id>00a1aba9-8964-4af9-be97-f38e3bf4f8d3</Id>
  <HashAlgorithm>SHA512</HashAlgorithm>
  <EntityType>Script</EntityType>
  <TimeStamp>2025-04-16T13:26:06.7888453Z</TimeStamp>
  <Duration>-1.00:00:00</Duration>
  <Key>0x9559f6017247e3e2</Key>
  <Signature>
    j6UB5ECO9+iq7VgYWm1wTYbmFoZOfMkhNgtF31DSeE6RBl8JwsrvDhNpXCOacMTL4j4YY/obXJ5k
    1LxS6/1F+NTVANFyGh0mrioXItjmfiXGhRmIujYrKqXzUv7tNGUynA8BkbnXKbq2332cmqGJ9y0K
    shB2Dkx+DDufrQib+wHYrCcGkaQ7rAkTeRIiS3Yd7vJUiRdlG6FD1Q2a/SFU5O7sAgmNjl/An9AH
    eT94UfUjHLVzXOAurz5uNzheVMS3i8YjnTHIpSq7XoJrDE0eyVv11vybrtphTGPmIfbNcwNXswaY
    iEsnKh4KbbU4rJHaU/ZhlM8WgGSwFOWlIFj986S/kYx8pWOrqWVkvfQtTcgQjWbbe8rCX+AlB8qm
    xMJQJsL0DzWHyCgUDQLPQfRpCE5y6JYy7bKfnRdYlJzCV7XE0+aLLJ87ZTjpYOJmO7MVwrzJ6mFr
    0/daSYTGYVcxVHR4f5N6J6XIljoytx9h3qIMJRKC3lJEMHwqztZZb0ZLSAAdr0HPS3Cb5Ps7d30Y
    W/yxs4H2FtFKNNHSTJKP5UPXhVYCnSWcPJEHybAACZMXwmKY/fAZ4k+RMma03epnxL2FeJriFfol
    kyVHqE92MSdqoTVzXIL5aGxmet8xsmoiwQK9uraGoR68BvhVN/XctgJU2CNt5pOvVW9kfgNY88z1
    lrKpb/rN0iQExCCFMtPsZrzEiG2xi87puszpj+04iHbz1bL6zATCPxdcGCCZtf2WLnaSTHwPENxZ
    EbJxd/fEEJkJfF2/N2P1bwJViyLldaeUt3HuVe6JUorKUERMAyf6dYR5DYfxOAH+u2kWu7dCH/I/
    HEWKKcq3E5muX5zLd9GBiEo+MlURbcOt3iJJYn7GEhBW8/mXtDZYmk+dpymnfpYkS5YKetbfqgRu
    Zr7oTjZerEqqXttCzFGgvS0b83oyf6vfhRlPT26sLub4HESiwJQe4jIyeidyYaBV3hffIaJOrOSP
    qLZRObu7/1cJ7z+ScAbu7voHkLwMIEbpJ61xQc6akxiajP6aojlQj0Ek5wpvLCT3PbOKtUT2UmE1
    bTouB428K6oM5PQE5li4iww7A+gdTo4JxxJP0g5x31MWU4QXbt0hDxcZLTWEXJ0JNPWFCdRjorei
    mrl9y7xG8NDa1Twe1pJ5yaSge9Tdy2lvsLgJVJMmYExtIRR+hAp7eDTKewm2nuH+43RJ03eg3xn8
    4RxqZLt+jROeEO/iN88rg+GS9SiXAOozcUHaLM1T3wt5o6ZxdkBg7ODFxjxL3erRe94PZecOCMPZ
    d97navoSbwkYJhqw9U/8qi9QEUtCotxP9fufKtsePwnxbsB7tfzTv6zIybCf7i5NgacIF6LM5+4h
    g5nGqIirhMfBbDEkLqnOyJFqqBOmnfgo6ftNQk2uHu5+uIeRaVaxo63At/8pOc529N7j1/dxOUyp
    nAK3g4n3DKQTDDuWQEM40jPfWJ3ybEqb23l9Hbs1EW4IfCDIeYfuUugjvZrbs7SAsNgmX0nmx96j
    ilkqGjt/9f0/CGv4ndg++yJ7ppGe88JpvGn++jL2X6fQTubbkXBAO1Z3+D65+PeKsHNN6HwmoiS9
    Y65hH9Qz2oBu6AYhF3NI54OwYZ5S65+/uCByIMOkM28sTuF6Wu0LaRSzL8XK8xPnnYGeZwCl7RZn
    lZDyE6SfseMlGL606H2JCROD5bla5xSuYGkfbntsc0uMUdCfxFC+kgB/yCw7Fz56bGjlnyZfbX02
    A10xHJHyVJ+j9vOUS/dHvMsCf+2RHEzs+0e3Apt9iDg2c1dOxQEA34dO+OJu+Y9fIX1Muk/wjFe5
    7R77r6sPCMpFSKEwTgAs3cgFK7fKM+uZvqwHtX7T8Rmv0SR+Ynq6CKM1iLJx29Eeim7kl5yhKaLg
    /E2kp1xclT9VaWWPxOoJvEoQx2LwtMQ2dCO7fnn93XFb7Eigw+kdxAvkLUVVWgoNL4txB5DIvFWP
    9tm3+P5jZUp/TVUwUjN2MkLLm49Q8q662hgwrn1GsSSVITZh5y+J3c+PpdjYBwUkF9d/pC6R2pXt
    +udfoRHiY4Ndr1DrQUljm5A0WwMYYW20yYKlivrzK0KYv9x5/5KDGO9LX/uXc7klk8WvxnFo45Qz
    FiI67yaUvTOBYAacrjANYjmdWZEs0fG/dU2L1f44JRGc3ebdlBAXVRH6Q7k65J6LrBO+vy5FJ0sN
    umQZxEeOOpRBjE04SJdnNlFaozoWZzY/i5O5y+uHt1JPp/3vR3ydVmbRkiey6nDSEFnG3c+Cw2KG
    aYqkjyKorC0u6e7PgcDZ/yHiE2bRJuEaXMv8BoSzpi35NeZ/pDkvGOE4EXZ7MKwRoE7LcMuatOzP
    Udz3ejJxG4Z+SFu6MTGRRCWc/tTcv/oqmE86hlEWQNwafxaWpYWh3oHkjKDgnsmNww2+tBze6YBg
    n2mW7VirPlNLZioMB+MwULZGg3kXX3g7/OWutvZ3mGs1yu9N6ZRMt4GhiWVMFkriGsHXcplzb5PA
    eJrg1vIF7osmPuzGhSeFVOq7HSemeElAf9Smum53vsGNn8mQjm3c3s7S/81Mg85lhQNMoREMG7QF
    qFPDDoZ5BJatoVZn9lopH1OFW0Qrdrn4RtpyJj38JpDB/Yc+Z+zFxlAq1cy75SZvLZGvklcRnjsA
    axBN4/EvYcpcXUqjPCP+LUw1XAABH1kHnu/0gUaZv9PK9PAN0FKORYHUqzgcsXvbdS8JiPM=
  </Signature>
</Certificate>

-----BEGIN PGP SIGNATURE-----
Comment: Eagle Package Repository

iQIzBAABCAAdFiEEw8dROIPu3TrtH+QlUCyWr0ldwtkFAmf/sDIACgkQUCyWr0ld
wtklog//XkO0gPo1I+tI8Nr+N3hJv6rwE7+c2qn9tF2hv5aSUT0uqm1Sv048VcXu
ITAIR1uwmuF24OxKN9u6/JiWycLY4BAid2JDtY2d1sKLozeE/mg18K/m7Z2jt051
b76tafbbrvuEbWrNhYt8duxM+g+3q6gssw7KiTe1ZGNEf+7pFPFNewcxeBsaYDAB
3VAS/5uz3z0FgHhfOKy8blF8zZfdjw9qxwoWfNGgkePEBA3H69S5gwqauMnjPush
UHoMbbhwkMq4rMgTm1iOLENv8r5yicm0NiSYzGefRaIsgUJPYk3hwq0mIWDHK2KE
EnHHJNf9Da6ngB97gK16jCYdEsPq+2lqacDnRRiQN4B8SadGYcGejOfKQvHyF1hP
FQi0+24zCmU3s8kf1CusCKMgZyp/vG5iGV4ruxuKjAGAzdb7e1X1MnEMgAx+D7mC
nccjQ0W8haWM2/Slt0/QncgDqbhip1UpvrTrcXWy9+Qto4+A4BzPkQxS11H0tHQ4
/DKGugrIo3kbSztMbiNCriIsbPrHdPmoDxH2owc2Vxle4r73IEs2d8TWmm0jtfgm
y4n1zZuV1yQXCm98sD0GZ3vVXWFWwDGdxgk7OaCKKZUHCKghBLnrqfRrx6P8mP7W
1FRr0aYhcJvBBU01PLMxFNKJrw5MOvLUQZg4X/aProFUnl1irrM=
=EahN
-----END PGP SIGNATURE-----