[CmdletBinding()]

param(

[switch]$Sign,

[switch]$NoSign,

[string]$Thumbprint,

[switch]$Binaries,

[switch]$Install,

[switch]$IntuneWin,

[switch]$Dev,

[switch]$SignMSI,

[switch]$SkipMSI,

[switch]$PackageOnly,

[switch]$NupkgOnly,

[switch]$MsiOnly,

[switch]$PkgOnly,

[switch]$Clean,

[switch]$Test,

[ValidateSet('Debug', 'Release')]

[string]$Configuration = 'Release',

[ValidateSet('x64', 'arm64', 'both')]

[string]$Architecture = 'both'

)

$ErrorActionPreference = 'Stop'

$ProgressPreference = 'SilentlyContinue'

function Write-BuildLog {

param(

[string]$Message,

[ValidateSet("INFO", "WARNING", "ERROR", "SUCCESS")]

[string]$Level = "INFO"

)

$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

$color = switch ($Level) {

"INFO" { "Cyan" }

"WARNING" { "Yellow" }

"ERROR" { "Red" }

"SUCCESS" { "Green" }

}

Write-Host "[$timestamp] " -NoNewline -ForegroundColor DarkGray

Write-Host "[$Level] " -NoNewline -ForegroundColor $color

Write-Host $Message

}

function Import-DotEnv {

param([string]$Path = ".env")

if (Test-Path $Path) {

Write-BuildLog "Loading environment variables from $Path"

Get-Content $Path | ForEach-Object {

if ($_ -match '^\s*([^#][^=]*)\s*=\s*(.*)\s*$') {

$name = $matches[1].Trim()

$value = $matches[2].Trim()

if ($value -match '^"(.*)"$' -or $value -match "^'(.*)'$") {

$value = $matches[1]

}

[Environment]::SetEnvironmentVariable($name, $value, [EnvironmentVariableTarget]::Process)

}

}

}

}

$Global:EnterpriseCertCN = $env:STARTSET_CERT_CN ?? $env:CIMIAN_CERT_CN ?? 'EmilyCarrU Intune Windows Enterprise Certificate'

$Global:EnterpriseCertSubject = $env:STARTSET_CERT_SUBJECT ?? $env:CIMIAN_CERT_SUBJECT ?? 'EmilyCarrU'

$script:RootDir = $PSScriptRoot

$script:OutputDir = Join-Path $RootDir 'release'

$script:BuildDir = Join-Path $RootDir 'build'

$script:SrcDir = Join-Path $RootDir 'src'

function Test-Command {

param ([string]$Command)

return $null -ne (Get-Command $Command -ErrorAction SilentlyContinue)

}

function Test-CimiPkg {

$c = Get-Command cimipkg.exe -ErrorAction SilentlyContinue

if ($c) { return $true }

# Check in common locations

$possiblePaths = @(

"$PSScriptRoot\..\CimianToolsGo\release\x64\cimipkg.exe",

"$PSScriptRoot\..\..\packages\CimianToolsGo\release\x64\cimipkg.exe",

"C:\Program Files\Cimian\cimipkg.exe"

)

foreach ($path in $possiblePaths) {

if (Test-Path $path) {

return $true

}

}

return $false

}

function Get-CimiPkgPath {

$c = Get-Command cimipkg.exe -ErrorAction SilentlyContinue

if ($c) { return $c.Source }

# Check in common locations

$possiblePaths = @(

"$PSScriptRoot\..\CimianToolsGo\release\x64\cimipkg.exe",

"$PSScriptRoot\..\..\packages\CimianToolsGo\release\x64\cimipkg.exe",

"C:\Program Files\Cimian\cimipkg.exe"

)

foreach ($path in $possiblePaths) {

if (Test-Path $path) {

return $path

}

}

throw "cimipkg.exe not found. Build CimianToolsGo first or add cimipkg to PATH."

}

function Get-SigningCertThumbprint {

[OutputType([hashtable])]

param([string]$ProvidedThumbprint)

# Use provided thumbprint first

if ($ProvidedThumbprint) {

$cert = Get-ChildItem Cert:\CurrentUser\My | Where-Object { $_.Thumbprint -eq $ProvidedThumbprint }

if ($cert) {

return @{ Thumbprint = $cert.Thumbprint; Store = "CurrentUser"; Certificate = $cert }

}

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq $ProvidedThumbprint }

if ($cert) {

return @{ Thumbprint = $cert.Thumbprint; Store = "LocalMachine"; Certificate = $cert }

}

}

# Check CurrentUser store first

$cert = Get-ChildItem Cert:\CurrentUser\My | Where-Object {

$_.HasPrivateKey -and $_.Subject -like "*$Global:EnterpriseCertSubject*"

} | Sort-Object NotAfter -Descending | Select-Object -First 1

if ($cert) {

return @{ Thumbprint = $cert.Thumbprint; Store = "CurrentUser"; Certificate = $cert }

}

# Check LocalMachine store

$cert = Get-ChildItem Cert:\LocalMachine\My | Where-Object {

$_.HasPrivateKey -and $_.Subject -like "*$Global:EnterpriseCertSubject*"

} | Sort-Object NotAfter -Descending | Select-Object -First 1

if ($cert) {

return @{ Thumbprint = $cert.Thumbprint; Store = "LocalMachine"; Certificate = $cert }

}

return $null

}

$Global:SignToolPath = $null

function Get-SignToolPath {

if ($Global:SignToolPath -and (Test-Path $Global:SignToolPath)) {

return $Global:SignToolPath

}

# Check PATH (prefer x64)

$c = Get-Command signtool.exe -ErrorAction SilentlyContinue

if ($c -and $c.Source -match '\\x64\\') {

$Global:SignToolPath = $c.Source

return $Global:SignToolPath

}

# Search Windows SDK

$programFilesx86 = [Environment]::GetFolderPath('ProgramFilesX86')

$searchRoot = Join-Path $programFilesx86 "Windows Kits\10\bin"

if (Test-Path $searchRoot) {

$candidates = Get-ChildItem -Path $searchRoot -Recurse -Filter "signtool.exe" -ErrorAction SilentlyContinue |

Where-Object { $_.FullName -match '\\x64\\' } |

Sort-Object { $_.Directory.Parent.Name } -Descending

if ($candidates -and $candidates.Count -gt 0) {

$Global:SignToolPath = $candidates[0].FullName

return $Global:SignToolPath

}

}

# Check registry

try {

$kitsRoot = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots" -Name KitsRoot10 -ErrorAction SilentlyContinue

if ($kitsRoot) {

$regRoot = Join-Path $kitsRoot.KitsRoot10 'bin'

if (Test-Path $regRoot) {

$candidates = Get-ChildItem -Path $regRoot -Recurse -Filter "signtool.exe" -ErrorAction SilentlyContinue |

Where-Object { $_.FullName -match '\\x64\\' } |

Sort-Object { $_.Directory.Parent.Name } -Descending

if ($candidates -and $candidates.Count -gt 0) {

$Global:SignToolPath = $candidates[0].FullName

return $Global:SignToolPath

}

}

}

} catch {}

return $null

}

function Test-SignTool {

$path = Get-SignToolPath

if (-not $path) {

throw "signtool.exe not found. Install Windows 10/11 SDK (Signing Tools)."

}

}

function Invoke-SignArtifact {

param(

[Parameter(Mandatory)][string]$Path,

[Parameter(Mandatory)][string]$Thumbprint,

[string]$Store = "CurrentUser",

[int]$MaxAttempts = 4

)

if (-not (Test-Path -LiteralPath $Path)) {

throw "File not found: $Path"

}

$signToolExe = Get-SignToolPath

if (-not $signToolExe) {

throw "signtool.exe not found. Install Windows 10/11 SDK."

}

$storeParam = if ($Store -eq "CurrentUser") { "/s", "My" } else { "/s", "My", "/sm" }

$tsas = @(

'http://timestamp.digicert.com',

'http://timestamp.sectigo.com',

'http://timestamp.entrust.net/TSS/RFC3161sha2TS'

)

$attempt = 0

while ($attempt -lt $MaxAttempts) {

$attempt++

foreach ($tsa in $tsas) {

try {

Write-BuildLog "Signing (attempt $attempt): $Path" "INFO"

$signArgs = @(

"sign"

"/sha1", $Thumbprint

"/tr", $tsa

"/td", "sha256"

"/fd", "sha256"

) + $storeParam + @($Path)

$psi = New-Object System.Diagnostics.ProcessStartInfo

$psi.FileName = $signToolExe

$psi.Arguments = $signArgs -join ' '

$psi.UseShellExecute = $false

$psi.RedirectStandardOutput = $true

$psi.RedirectStandardError = $true

$psi.CreateNoWindow = $true

$process = [System.Diagnostics.Process]::Start($psi)

$null = $process.StandardOutput.ReadToEnd()

$null = $process.StandardError.ReadToEnd()

$process.WaitForExit()

if ($process.ExitCode -eq 0) {

Write-BuildLog "Successfully signed: $Path" "SUCCESS"

return

}

}

catch {

Write-BuildLog "Signing attempt failed: $_" "WARNING"

}

Start-Sleep -Seconds (2 * $attempt)

}

}

throw "Signing failed after $MaxAttempts attempts: $Path"

}

function Invoke-SignNuget {

param(

[Parameter(Mandatory)][string]$NupkgPath,

[string]$Thumbprint

)

if (-not (Test-Path $NupkgPath)) {

throw "NuGet package '$NupkgPath' not found."

}

if (-not $Thumbprint) {

$certInfo = Get-SigningCertThumbprint

$Thumbprint = if ($certInfo) { $certInfo.Thumbprint } else { $null }

}

if (-not $Thumbprint) {

Write-BuildLog "No enterprise code-signing cert present - skipping NuGet signing." "WARNING"

return $false

}

$tsa = 'http://timestamp.digicert.com'

& nuget.exe sign $NupkgPath `

-CertificateStoreName My `

-CertificateSubjectName $Global:EnterpriseCertCN `

-Timestamper $tsa

if ($LASTEXITCODE) {

Write-BuildLog "nuget sign failed ($LASTEXITCODE) for '$NupkgPath'" "WARNING"

return $false

}

Write-BuildLog "NuGet package signed: $NupkgPath" "SUCCESS"

return $true

}

function Get-BuildVersion {

$currentTime = Get-Date

$fullVersion = $currentTime.ToString("yyyy.MM.dd.HHmm")

$semanticVersion = "{0}.{1}.{2}.{3}" -f ($currentTime.Year - 2000), $currentTime.Month, $currentTime.Day, $currentTime.ToString("HHmm")

return @{

Full = $fullVersion

Semantic = $semanticVersion

MsiCompatible = "{0}.{1}.{2}{3:D2}" -f ($currentTime.Year - 2000), $currentTime.Month, $currentTime.Day, [int]$currentTime.ToString("HH")

}

}

function Initialize-BuildEnvironment {

Write-BuildLog "Initializing build environment..."

# Create output directories

$archs = if ($Architecture -eq 'both') { @('x64', 'arm64') } elseif ($Architecture -eq 'x64') { @('x64') } else { @('arm64') }

foreach ($arch in $archs) {

$archDir = Join-Path $OutputDir $arch

if (-not (Test-Path $archDir)) {

New-Item -ItemType Directory -Path $archDir -Force | Out-Null

}

}

# Verify dotnet is available

if (-not (Test-Command "dotnet")) {

throw ".NET SDK not found. Please install .NET SDK."

}

$dotnetVersion = & dotnet --version

Write-BuildLog "Using .NET SDK: $dotnetVersion" "SUCCESS"

}

function Invoke-Clean {

Write-BuildLog "Cleaning build artifacts..."

# Clean release directory

if (Test-Path $OutputDir) {

Remove-Item -Path "$OutputDir\*" -Recurse -Force -ErrorAction SilentlyContinue

}

# Clean bin/obj folders in projects

Get-ChildItem -Path $SrcDir -Include 'bin', 'obj' -Recurse -Directory | ForEach-Object {

Remove-Item -Path $_.FullName -Recurse -Force -ErrorAction SilentlyContinue

}

Write-BuildLog "Clean complete" -Level 'SUCCESS'

}

function Build-Solution {

Write-BuildLog "Building solution..."

$solutionPath = Join-Path $RootDir 'StartSet.sln'

$config = if ($Dev) { 'Debug' } else { $Configuration }

$buildArgs = @(

'build',

$solutionPath,

'--configuration', $config,

'--verbosity', 'minimal'

)

Write-BuildLog "dotnet $($buildArgs -join ' ')"

& dotnet @buildArgs

if ($LASTEXITCODE -ne 0) {

throw "Solution build failed with exit code $LASTEXITCODE"

}

Write-BuildLog "Solution build complete" -Level 'SUCCESS'

}

function Publish-Binary {

param(

[string]$Name,

[string]$ProjectPath,

[string]$RuntimeIdentifier,

[string]$OutputPath,

[hashtable]$Version

)

$config = if ($Dev) { 'Debug' } else { $Configuration }

$publishArgs = @(

'publish',

$ProjectPath,

'--configuration', $config,

'--runtime', $RuntimeIdentifier,

'--self-contained', 'true',

'--output', $OutputPath,

'-p:PublishSingleFile=true',

'-p:PublishReadyToRun=true',

'-p:EnableCompressionInSingleFile=true',

'-p:IncludeNativeLibrariesForSelfExtract=true',

"-p:Version=$($Version.Full)",

'--verbosity', 'minimal'

)

Write-BuildLog "Publishing $Name for $RuntimeIdentifier..."

& dotnet @publishArgs

if ($LASTEXITCODE -ne 0) {

throw "Failed to publish $Name for $RuntimeIdentifier"

}

Write-BuildLog "$Name ($RuntimeIdentifier) built successfully" -Level 'SUCCESS'

}

function Build-AllBinaries {

param([hashtable]$Version)

$archs = if ($Architecture -eq 'both') { @('x64', 'arm64') } elseif ($Architecture -eq 'x64') { @('x64') } else { @('arm64') }

$runtimeMap = @{ 'x64' = 'win-x64'; 'arm64' = 'win-arm64' }

Write-BuildLog "Target architectures: $($archs -join ', ')"

foreach ($arch in $archs) {

$runtime = $runtimeMap[$arch]

$outputPath = Join-Path $OutputDir $arch

if (-not (Test-Path $outputPath)) {

New-Item -ItemType Directory -Path $outputPath -Force | Out-Null

}

# Build CLI

$cliProject = Join-Path $SrcDir "CLI\StartSet.CLI.csproj"

Publish-Binary -Name "StartSet CLI" -ProjectPath $cliProject -RuntimeIdentifier $runtime -OutputPath $outputPath -Version $Version

# Rename CLI executable

$cliExe = Join-Path $outputPath "StartSet.CLI.exe"

$targetCliExe = Join-Path $outputPath "managedstatekeeper.exe"

if (Test-Path $cliExe) {

Move-Item $cliExe $targetCliExe -Force

}

# Build Service

$serviceProject = Join-Path $SrcDir "Service\StartSet.Service.csproj"

Publish-Binary -Name "StartSet Service" -ProjectPath $serviceProject -RuntimeIdentifier $runtime -OutputPath $outputPath -Version $Version

# Rename Service executable

$serviceExe = Join-Path $outputPath "StartSet.Service.exe"

$targetServiceExe = Join-Path $outputPath "StartSetService.exe"

if (Test-Path $serviceExe) {

Move-Item $serviceExe $targetServiceExe -Force

}

# Clean up PDB files

Get-ChildItem -Path $outputPath -Filter "*.pdb" | Remove-Item -Force

}

Write-BuildLog "All binaries built successfully" -Level 'SUCCESS'

}

function Invoke-SignAllBinaries {

param(

[string]$Thumbprint,

[string]$CertStore

)

Write-BuildLog "Signing all executables..."

Test-SignTool

# Force garbage collection to release file handles

[System.GC]::Collect()

[System.GC]::WaitForPendingFinalizers()

Start-Sleep -Seconds 2

$archs = if ($Architecture -eq 'both') { @('x64', 'arm64') } elseif ($Architecture -eq 'x64') { @('x64') } else { @('arm64') }

foreach ($arch in $archs) {

$archDir = Join-Path $OutputDir $arch

$exeFiles = Get-ChildItem -Path $archDir -Filter "*.exe" -File -ErrorAction SilentlyContinue

foreach ($exe in $exeFiles) {

try {

Invoke-SignArtifact -Path $exe.FullName -Thumbprint $Thumbprint -Store $CertStore

}

catch {

Write-BuildLog "Failed to sign $($exe.Name): $_" -Level 'WARNING'

}

}

}

Write-BuildLog "Binary signing complete" -Level 'SUCCESS'

}

function Build-MsiPackage {

param(

[string]$Arch,

[hashtable]$Version,

[switch]$Sign,

[string]$Thumbprint,

[string]$CertStore

)

Write-BuildLog "Building MSI for $Arch..." "INFO"

# Check for cimipkg

if (-not (Test-CimiPkg)) {

Write-BuildLog "cimipkg.exe not found. Build CimianTools first or add cimipkg to PATH." "ERROR"

return $null

}

$cimipkgPath = Get-CimiPkgPath

Write-BuildLog "Using cimipkg: $cimipkgPath" "INFO"

$binDir = Join-Path $OutputDir $Arch

if (-not (Test-Path $binDir)) {

Write-BuildLog "Binary directory not found: $binDir" "ERROR"

return $null

}

# Create temporary MSI build directory

$msiTempDir = Join-Path $OutputDir "msi_$Arch"

if (Test-Path $msiTempDir) {

Remove-Item $msiTempDir -Recurse -Force

}

New-Item -ItemType Directory -Path $msiTempDir -Force | Out-Null

# Create payload directory and copy binaries

$payloadDir = Join-Path $msiTempDir "payload"

New-Item -ItemType Directory -Path $payloadDir -Force | Out-Null

Write-BuildLog "Copying StartSet binaries for $Arch to MSI payload..." "INFO"

$binaries = @("managedstatekeeper.exe", "StartSetService.exe")

foreach ($binary in $binaries) {

$sourcePath = Join-Path $binDir $binary

if (Test-Path $sourcePath) {

Copy-Item $sourcePath $payloadDir -Force

Write-BuildLog "Copied $binary to MSI payload" "INFO"

} else {

Write-BuildLog "Binary not found: $sourcePath" "WARNING"

}

}

# Create scripts directory with pre/postinstall

$scriptsDir = Join-Path $msiTempDir "scripts"

New-Item -ItemType Directory -Path $scriptsDir -Force | Out-Null

$postinstallTemplatePath = Join-Path $BuildDir "pkg\postinstall.ps1"

if (Test-Path $postinstallTemplatePath) {

$postinstallContent = Get-Content $postinstallTemplatePath -Raw

$postinstallContent = $postinstallContent -replace '\{\{VERSION\}\}', $Version.Full

$postinstallContent | Set-Content (Join-Path $scriptsDir "postinstall.ps1") -Encoding UTF8

Write-BuildLog "Added postinstall.ps1 script" "INFO"

}

$preinstallTemplatePath = Join-Path $BuildDir "pkg\preinstall.ps1"

if (Test-Path $preinstallTemplatePath) {

$preinstallContent = Get-Content $preinstallTemplatePath -Raw

$preinstallContent = $preinstallContent -replace '\{\{VERSION\}\}', $Version.Full

$preinstallContent | Set-Content (Join-Path $scriptsDir "preinstall.ps1") -Encoding UTF8

Write-BuildLog "Added preinstall.ps1 script" "INFO"

}

# Create build-info.yaml from template

$buildInfoTemplatePath = Join-Path $BuildDir "pkg\build-info.yaml"

if (-not (Test-Path $buildInfoTemplatePath)) {

Write-BuildLog "build-info.yaml template not found: $buildInfoTemplatePath" "ERROR"

Remove-Item $msiTempDir -Recurse -Force -ErrorAction SilentlyContinue

return $null

}

$buildInfoContent = Get-Content $buildInfoTemplatePath -Raw

$buildInfoContent = $buildInfoContent -replace '\{\{VERSION\}\}', $Version.Full

$buildInfoContent = $buildInfoContent -replace '\{\{ARCHITECTURE\}\}', $Arch

$buildInfoContent | Set-Content (Join-Path $msiTempDir "build-info.yaml") -Encoding UTF8

Write-BuildLog "Created build-info.yaml for MSI" "INFO"

# Build MSI using cimipkg (default format is MSI)

try {

$cimipkgArgs = @("--verbose")

if ($Sign -and $Thumbprint) {

$cimipkgArgs += @("--sign-thumbprint", $Thumbprint)

}

$cimipkgArgs += $msiTempDir

$process = Start-Process -FilePath $cimipkgPath -ArgumentList $cimipkgArgs -Wait -NoNewWindow -PassThru

if ($process.ExitCode -eq 0) {

# Look for the created .msi in the build subdirectory

$cimipkgBuildDir = Join-Path $msiTempDir "build"

if (Test-Path $cimipkgBuildDir) {

$createdMsi = Get-ChildItem -Path $cimipkgBuildDir -Filter "*.msi" | Select-Object -First 1

if ($createdMsi) {

$finalName = "StartSet-$($Version.Full)-$Arch.msi"

$finalPath = Join-Path $OutputDir $finalName

Move-Item $createdMsi.FullName $finalPath -Force

$msiSize = (Get-Item $finalPath).Length / 1MB

Write-BuildLog "MSI created: $finalName ($($msiSize.ToString('F2')) MB)" "SUCCESS"

Remove-Item $msiTempDir -Recurse -Force -ErrorAction SilentlyContinue

return $finalPath

}

}

Write-BuildLog "MSI file not found in cimipkg build directory" "WARNING"

} else {

Write-BuildLog "cimipkg failed with exit code $($process.ExitCode)" "ERROR"

}

}

catch {

Write-BuildLog "Failed to create MSI package: $_" "ERROR"

}

# Clean up temp directory on failure

Remove-Item $msiTempDir -Recurse -Force -ErrorAction SilentlyContinue

return $null

}

function Build-NuGetPackage {

param(

[string]$Arch,

[hashtable]$Version,

[switch]$Sign,

[string]$Thumbprint

)

Write-BuildLog "Creating NuGet package for $Arch..." "INFO"

# Check for nuget

if (-not (Test-Command "nuget")) {

Write-BuildLog "nuget.exe not found - skipping NuGet package creation" "WARNING"

return $null

}

# Use template from build/nupkg/

$templatePath = Join-Path $BuildDir "nupkg\StartSet.nuspec.template"

if (-not (Test-Path $templatePath)) {

Write-BuildLog "NuGet template not found: $templatePath" "ERROR"

return $null

}

# Create temp nuspec directory

$tempNuspecDir = Join-Path $env:TEMP "StartSet-nupkg-$Arch-$(Get-Random)"

New-Item -ItemType Directory -Path $tempNuspecDir -Force | Out-Null

$nuspecPath = Join-Path $tempNuspecDir "StartSet.$Arch.nuspec"

# Read template and replace placeholders

$nuspecContent = Get-Content $templatePath -Raw

$nuspecContent = $nuspecContent -replace '{{VERSION}}', $Version.Semantic

$nuspecContent = $nuspecContent -replace '{{ARCHITECTURE}}', $Arch

$nuspecContent | Set-Content -Path $nuspecPath -Encoding UTF8

Write-BuildLog "Created nuspec from template for $Arch" "INFO"

$nupkgOutput = Join-Path $OutputDir "StartSet-$Arch.$($Version.Semantic).nupkg"

# Pack

& nuget pack $nuspecPath -OutputDirectory $OutputDir -BasePath $tempNuspecDir -NoDefaultExcludes

# Cleanup temp directory

Remove-Item $tempNuspecDir -Recurse -Force -ErrorAction SilentlyContinue

if ($LASTEXITCODE -ne 0) {

Write-BuildLog "NuGet pack failed for $Arch" "WARNING"

return $null

}

# Find and rename the package

$builtPkg = Get-ChildItem $OutputDir -Filter "StartSet-$Arch*.nupkg" | Sort-Object LastWriteTime -Descending | Select-Object -First 1

if ($builtPkg -and $builtPkg.FullName -ne $nupkgOutput) {

Move-Item $builtPkg.FullName $nupkgOutput -Force

}

if (Test-Path $nupkgOutput) {

Write-BuildLog "Created NuGet package: $(Split-Path $nupkgOutput -Leaf)" "SUCCESS"

if ($Sign) {

Invoke-SignNuget -NupkgPath $nupkgOutput -Thumbprint $Thumbprint

}

return $nupkgOutput

}

Write-BuildLog "NuGet package not found after build" "WARNING"

return $null

}

function Build-PkgPackage {

param(

[Parameter(Mandatory)][string]$Arch,

[Parameter(Mandatory)][hashtable]$Version,

[switch]$Sign,

[string]$Thumbprint,

[string]$Store

)

Write-BuildLog "Creating .pkg package for $Arch..." "INFO"

# Check for cimipkg

if (-not (Test-CimiPkg)) {

Write-BuildLog "cimipkg.exe not found. Build CimianToolsGo first or add cimipkg to PATH." "ERROR"

return $null

}

$cimipkgPath = Get-CimiPkgPath

Write-BuildLog "Using cimipkg: $cimipkgPath" "INFO"

$binDir = Join-Path $OutputDir $Arch

if (-not (Test-Path $binDir)) {

Write-BuildLog "Binary directory not found: $binDir" "ERROR"

return $null

}

# Create temporary .pkg build directory

$pkgTempDir = Join-Path $OutputDir "pkg_$Arch"

if (Test-Path $pkgTempDir) {

Remove-Item $pkgTempDir -Recurse -Force

}

New-Item -ItemType Directory -Path $pkgTempDir -Force | Out-Null

# Create payload directory and copy binaries

$payloadDir = Join-Path $pkgTempDir "payload"

New-Item -ItemType Directory -Path $payloadDir -Force | Out-Null

Write-BuildLog "Copying StartSet binaries for $Arch architecture to .pkg payload..." "INFO"

$binaries = @(

"managedstatekeeper.exe",

"StartSetService.exe"

)

foreach ($binary in $binaries) {

$sourcePath = Join-Path $binDir $binary

if (Test-Path $sourcePath) {

Copy-Item $sourcePath $payloadDir -Force

Write-BuildLog "Copied $binary to .pkg payload" "INFO"

} else {

Write-BuildLog "Binary not found: $sourcePath" "WARNING"

}

}

# Create scripts directory and copy pre/postinstall scripts

$scriptsDir = Join-Path $pkgTempDir "scripts"

New-Item -ItemType Directory -Path $scriptsDir -Force | Out-Null

# Copy and process postinstall script from build/pkg/ template

$postinstallTemplatePath = Join-Path $BuildDir "pkg\postinstall.ps1"

if (Test-Path $postinstallTemplatePath) {

$postinstallContent = Get-Content $postinstallTemplatePath -Raw

$postinstallContent = $postinstallContent -replace '\{\{VERSION\}\}', $Version.Full

$postinstallContent | Set-Content (Join-Path $scriptsDir "postinstall.ps1") -Encoding UTF8

Write-BuildLog "Added postinstall.ps1 script to .pkg" "INFO"

} else {

Write-BuildLog "Postinstall template not found: $postinstallTemplatePath" "WARNING"

}

# Copy and process preinstall script from build/pkg/ template

$preinstallTemplatePath = Join-Path $BuildDir "pkg\preinstall.ps1"

if (Test-Path $preinstallTemplatePath) {

$preinstallContent = Get-Content $preinstallTemplatePath -Raw

$preinstallContent = $preinstallContent -replace '\{\{VERSION\}\}', $Version.Full

$preinstallContent | Set-Content (Join-Path $scriptsDir "preinstall.ps1") -Encoding UTF8

Write-BuildLog "Added preinstall.ps1 script to .pkg" "INFO"

} else {

Write-BuildLog "Preinstall template not found: $preinstallTemplatePath" "WARNING"

}

# Copy and process build-info.yaml from build/pkg/ template

$buildInfoTemplatePath = Join-Path $BuildDir "pkg\build-info.yaml"

if (Test-Path $buildInfoTemplatePath) {

$buildInfoContent = Get-Content $buildInfoTemplatePath -Raw

$buildInfoContent = $buildInfoContent -replace '\{\{VERSION\}\}', $Version.Full

$buildInfoContent = $buildInfoContent -replace '\{\{ARCHITECTURE\}\}', $Arch

if ($Sign -and $Thumbprint) {

$buildInfoContent += @"

}

$buildInfoPath = Join-Path $pkgTempDir "build-info.yaml"

$buildInfoContent | Set-Content $buildInfoPath -Encoding UTF8

Write-BuildLog "Created build-info.yaml for .pkg" "INFO"

} else {

Write-BuildLog "build-info.yaml template not found: $buildInfoTemplatePath" "ERROR"

return $null

}

# Build the .pkg package using cimipkg

Write-BuildLog "Building .pkg package for $Arch architecture..." "INFO"

try {

$cimipkgArgs = @("--verbose", $pkgTempDir)

$process = Start-Process -FilePath $cimipkgPath -ArgumentList $cimipkgArgs -Wait -NoNewWindow -PassThru

if ($process.ExitCode -eq 0) {

Write-BuildLog ".pkg package created successfully for ${Arch}" "SUCCESS"

# Look for the created .pkg file in the build subdirectory

$buildDir = Join-Path $pkgTempDir "build"

if (Test-Path $buildDir) {

$createdPkgFiles = Get-ChildItem -Path $buildDir -Filter "*.pkg"

foreach ($pkgFile in $createdPkgFiles) {

# Move the .pkg to the release directory with proper naming

$pkgName = "StartSet-$($Version.Full)-$Arch.pkg"

$finalPkgPath = Join-Path $OutputDir $pkgName

Move-Item $pkgFile.FullName $finalPkgPath -Force

$pkgSize = (Get-Item $finalPkgPath).Length / 1MB

Write-BuildLog ".pkg created: $pkgName ($($pkgSize.ToString('F2')) MB)" "SUCCESS"

# Clean up temp directory

Remove-Item $pkgTempDir -Recurse -Force -ErrorAction SilentlyContinue

return $finalPkgPath

}

}

Write-BuildLog ".pkg file not found in build directory" "WARNING"

} else {

Write-BuildLog "cimipkg failed with exit code $($process.ExitCode)" "ERROR"

}

}

catch {

Write-BuildLog "Failed to create .pkg package: $_" "ERROR"

}

# Clean up temp directory on failure

Remove-Item $pkgTempDir -Recurse -Force -ErrorAction SilentlyContinue

return $null

}