#!/bin/bash
# sign-payload: build a tarball, sign it with Ed25519 privkey
set -e
TAR=$1
shift
OUT=${2:-payload.tar.gz}
SIGN_KEY=${SIGN_KEY:-ed25519-priv.hex}
PAYLOAD_SIG=payload.sig

# Files to tar
FILES=("$@")

tar czf "$OUT" "${FILES[@]}"

# Hash tarball
PAYLOAD_HASH=$(sha256sum "$OUT" | cut -d' ' -f1)

echo "Signing $OUT..." >&2
# Use common payload signing tool (assumes Rust build, demo only)
if [ ! -f "$SIGN_KEY" ]; then
  echo "must provide SIGN_KEY=ed25519-priv.hex" >&2
  exit 1
fi
cat "$OUT" | xxd -p -c 256 | tr -d '\n' > payload.hex
# The following assumes sign_payload is available: `cargo run --bin sign_payload < payload.hex > payload.sig`
# Or use dalek CLI e.g. minisign, see README

echo "$PAYLOAD_HASH" > payload.hash
# For demo, just leave signature as TODO