import crypto from "node:crypto";
import fs from "node:fs/promises";

export async function verifyFileSha256(filePath, shaFilePath, expectedSha256 = "") {
  const fileBuffer = await fs.readFile(filePath);
  const expected = (await fs.readFile(shaFilePath, "utf8")).trim().split(/\s+/)[0];
  const actual = crypto.createHash("sha256").update(fileBuffer).digest("hex");

  if (expected.toLowerCase() !== actual.toLowerCase()) {
    throw new Error(`SHA256 mismatch for ${filePath}`);
  }

  if (expectedSha256 && expectedSha256.toLowerCase() !== actual.toLowerCase()) {
    throw new Error(`Release manifest SHA256 mismatch for ${filePath}`);
  }
}
