$ErrorActionPreference = 'Stop'
$linux = @'
set -euo pipefail
SRC_WIN='/mnt/c/ProgramData/kube-bot/incoming/infisical/infisical-backup-20260611-233438-transfer-20260612-073445.tar.gz'
EXPECTED='653ba589b1bb6bbcf50cde91de0cda6f08b2414c14af093827f1a9c1d4cd5d3c'
WORK=/opt/infisical/imports/nas-20260611-233438
rm -rf "$WORK"
install -d -m 700 "$WORK"
echo '== verify archive =='
ACTUAL=$(sha256sum "$SRC_WIN" | awk '{print $1}')
echo "sha256=$ACTUAL"
[ "$ACTUAL" = "$EXPECTED" ]
cp "$SRC_WIN" "$WORK/archive.tar.gz"
cd "$WORK"
tar -xzf archive.tar.gz
echo '== extracted tree =='
find . -maxdepth 3 -type f -printf '%P %s bytes\n' | sort
# locate backup dir containing dump/env
BDIR=$(find "$WORK" -type f -name 'infisical-db.dump' -printf '%h\n' | head -1)
[ -n "$BDIR" ]
echo "backup_dir=$BDIR"
# Verify embedded checksums if possible, but don't print secrets
if [ -f "$BDIR/SHA256SUMS" ]; then
  echo '== embedded sha256 =='
  ( cd "$BDIR" && sha256sum -c SHA256SUMS )
fi
# Run existing restore-test helper against extracted real NAS backup
/opt/infisical/bin/restore-test-infisical.sh "$BDIR"
'@
$b64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($linux))
$b64 | wsl -d Ubuntu -u root -- bash -lc 'base64 -d > /root/nas-backup-restore-test.sh && chmod +x /root/nas-backup-restore-test.sh && bash /root/nas-backup-restore-test.sh'