punktfunk/packaging/windows/stage-pf-vdisplay.ps1

<#
.SYNOPSIS
  Stage the pf-vdisplay driver bundle the installer ships into -OutDir: the VENDORED signed pf-vdisplay
  driver + the fetched nefcon device tool.

.DESCRIPTION
  pf-vdisplay (our all-Rust IddCx virtual display) is built from packaging/windows/drivers/, and
  the SIGNED output (pf_vdisplay.dll/.inf/.cat + punktfunk-driver.cer) is VENDORED under
  packaging/windows/pf-vdisplay/ (signer punktfunk-ds-test - shared with the gamepad drivers - Class=
  Display, HWID root\pf_vdisplay). Rebuild + re-vendor with
  packaging/windows/drivers/deploy-dev.ps1 when the driver source changes, then copy the staged
  pf_vdisplay.{dll,inf,cat} over the vendored copies. nefcon publishes a pinned release, so we fetch +
  SHA-256-verify it (it provides nefconc.exe, used to create the root-enumerated device node - pnputil
  can't).

  Output (consumed by punktfunk-host.iss): -OutDir gets pf_vdisplay.inf/.cat/.dll + punktfunk-driver.cer
  and nefconc.exe (x64). pack-host-installer.ps1 also drops install-pf-vdisplay.ps1 in.

.EXAMPLE
  pwsh -File stage-pf-vdisplay.ps1 -OutDir C:\t\out\stage
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)][string]$OutDir,
    [string]$VendorDir = (Join-Path $PSScriptRoot 'pf-vdisplay'),
    # PINNED nefcon release (https://github.com/nefarius/nefcon/releases). MIT-licensed.
    [string]$NefconUrl = 'https://github.com/nefarius/nefcon/releases/download/v1.17.40/nefcon_v1.17.40.zip',
    [string]$NefconSha256 = '812bae7ed7dfb7d6d2284bc7de2f8ccebc92ed2a0b1ae893c53b337096e50c1a'
)
$ErrorActionPreference = 'Stop'
$ProgressPreference = 'SilentlyContinue'
$PSNativeCommandUseErrorActionPreference = $false

if (Test-Path $OutDir) { Remove-Item -Recurse -Force $OutDir }
New-Item -ItemType Directory -Force -Path $OutDir | Out-Null

# --- vendored pf-vdisplay driver --------------------------------------------------------------
$inf = Get-ChildItem -Path $VendorDir -Filter pf_vdisplay.inf -ErrorAction SilentlyContinue | Select-Object -First 1
if (-not $inf) { throw "no vendored pf_vdisplay.inf under $VendorDir - re-vendor via drivers/deploy-dev.ps1" }
Copy-Item (Join-Path $VendorDir '*') $OutDir -Force
Write-Host "==> vendored pf-vdisplay staged from $VendorDir"

# --- nefcon (fetched + verified) --------------------------------------------------------------
$work = Join-Path ([IO.Path]::GetTempPath()) ('nefcon-' + [IO.Path]::GetRandomFileName())
New-Item -ItemType Directory -Force -Path $work | Out-Null
try {
    $zip = Join-Path $work 'nefcon.zip'
    Write-Host "==> downloading $NefconUrl"
    Invoke-WebRequest -Uri $NefconUrl -OutFile $zip -UseBasicParsing
    $got = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLowerInvariant()
    if ($NefconSha256) {
        if ($got -ne $NefconSha256.ToLowerInvariant()) {
            throw "nefcon SHA-256 mismatch`n  expected $NefconSha256`n  got      $got"
        }
        Write-Host "    sha256 ok ($got)"
    }
    else { Write-Warning "no pinned nefcon SHA-256 - computed $got (PIN THIS in stage-pf-vdisplay.ps1)" }
    Expand-Archive -Path $zip -DestinationPath $work -Force
    $nefc = Get-ChildItem -Path $work -Recurse -Filter 'nefconc.exe' |
        Where-Object { $_.FullName -match '(?i)\\x64\\' } | Select-Object -First 1
    if (-not $nefc) { $nefc = Get-ChildItem -Path $work -Recurse -Filter 'nefconc.exe' | Select-Object -First 1 }
    if (-not $nefc) { throw "nefconc.exe not found in $NefconUrl" }
    Copy-Item $nefc.FullName (Join-Path $OutDir 'nefconc.exe') -Force
}
finally { Remove-Item -Recurse -Force $work -ErrorAction SilentlyContinue }

Write-Host "==> staged driver bundle in $OutDir :"
Get-ChildItem $OutDir -File | ForEach-Object { "    $($_.Name)" }