# Check PowerShell version for use in path
if ($PSVersionTable.PSVersion.Major -ge 3) {
    $currentDir = $PSScriptRoot
}
else {
    $currentDir = (Get-Item .).FullName
}

# Only run if the maker script flagged this build with -IgnoreSecBoot
$labConfigPath = "HKLM:\SYSTEM\Setup\LabConfig"
$flag = Get-ItemProperty -Path $labConfigPath -Name "IgnoreSecBootBootRes" -ErrorAction SilentlyContinue

if (-not $flag -or $flag.IgnoreSecBootBootRes -ne 1) {
    return
}

Write-Output "IgnoreSecBootBootRes flag set - checking Secure Boot state before touching BCD..."

# Confirm-SecureBootUEFI throws on legacy BIOS / non-UEFI firmware - no Secure Boot to worry about there
$secureBootOn = $false
try {
    $secureBootOn = Confirm-SecureBootUEFI
}
catch {
    Write-Output "Confirm-SecureBootUEFI unavailable (legacy BIOS/non-UEFI) - Secure Boot not applicable, proceeding."
    $secureBootOn = $false
}

if ($secureBootOn) {
    Write-Warning "Secure Boot is ENABLED - skipping testsigning/nointegritychecks. Windows ignores both settings while Secure Boot is on, and forcing them here would do nothing but risk an inconsistent BCD. Disable Secure Boot in UEFI firmware, then re-run this script (`"$PSCommandPath`") manually to apply the settings - it only runs automatically once, during setup."
    return
}

& bcdedit /set '{current}' testsigning on | Out-Null
& bcdedit /set '{current}' nointegritychecks on | Out-Null

Write-Output "testsigning/nointegritychecks enabled - Secure Boot was off, so this should take effect on next reboot."