#!/usr/bin/env bash
set -Eeuo pipefail

OUTPUT=${1:-release-signing-private.pem}
[ ! -e "$OUTPUT" ] || { echo "$OUTPUT already exists" >&2; exit 1; }
umask 077
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out "$OUTPUT"
openssl pkey -in "$OUTPUT" -pubout -out "${OUTPUT%.pem}-public.pem"
if command -v sha256sum >/dev/null 2>&1; then
  PUBLIC_KEY_SHA256=$(sha256sum "${OUTPUT%.pem}-public.pem" | awk '{print $1}')
else
  PUBLIC_KEY_SHA256=$(shasum -a 256 "${OUTPUT%.pem}-public.pem" | awk '{print $1}')
fi
printf 'Private key: %s\nPublic key: %s\nTrusted public-key SHA-256: %s\n' \
  "$OUTPUT" "${OUTPUT%.pem}-public.pem" "$PUBLIC_KEY_SHA256"