$expectedManifestSha256 = Read-Host "Paste the publisher-provided 64-character manifest SHA-256 obtained through an independently trusted channel"
if ($expectedManifestSha256 -notmatch '^[0-9a-fA-F]{64}$') {
  throw "Expected manifest digest must be a 64-character hexadecimal SHA-256 value from the publisher-provided external manifest digest."
}

powershell -ExecutionPolicy Bypass -File .\scripts\install-server.ps1 `
  -SkipBuild `
  -ExpectedManifestSha256 $expectedManifestSha256 `
  -Configuration Release `
  -Listen 0.0.0.0:38580 `
  -NoDiscovery `
  -AllowUnsafePublicRelay `
  -TransportEncryption required `
  -ConfigureFirewall `
  -FirewallRemoteAddress "<trusted-client-cidr-or-ip>" `
  -ServiceAccount NetworkService `
  -Start `
  -VerifyInstall
