#!/usr/bin/env bash
set -euo pipefail

# Verify every commit in a release range has a cryptographically good Git
# signature. This is deliberately strict for release/main enforcement: unsigned
# or merely unknown signatures cannot become production provenance.
# Usage: verify-signed-commits.sh [range]  (default: HEAD)

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/casan-paths.sh"
ROOT="$CASAN_APP_ROOT"; RANGE="${1:-HEAD}"
commits=()
while IFS= read -r commit; do [[ -n "$commit" ]] && commits+=("$commit"); done < <(git -C "$ROOT" rev-list --reverse "$RANGE")
[[ "${#commits[@]}" -gt 0 ]] || { echo "SIGNED_COMMITS_FAIL empty_range=$RANGE" >&2; exit 1; }
for commit in "${commits[@]}"; do
  status="$(git -C "$ROOT" log -1 --format='%G?' "$commit")"
  [[ "$status" == G ]] || { echo "SIGNED_COMMITS_FAIL commit=$commit signature_status=$status" >&2; exit 1; }
done
echo "SIGNED_COMMITS_VERIFIED range=$RANGE count=${#commits[@]}"