feat(cargo-wdk): add --signtool-args passthrough to customize driver signing

[Shravan Vasista (svasista-ms)]

Adds --signtool-args passthrough so driver signing can be customized (certificate selection, digest algorithm, timestamping, extra file operands).

When --signtool-args is omitted, cargo-wdk signs with the auto-generated WDR test certificate and default switches.
When --signtool-args is provided, the caller owns the full signtool sign option set except the sign verb and the trailing file operand (spplied by cargo-wdk). Supplying it with --sign-mode=off is rejected.

⚠️ Behavior change

Packaging removes any existing <target>/<profile>/<name>_package folder at the start of each build and recreates it, so stale signing artifacts (e.g. a WDRLocalTestCert.cer from a previous --sign-mode=test build) don't persist across rebuilds.

Screenshots

Resolves #605

[Copilot]

Pull request overview

Adds a cargo wdk build --signtool-args passthrough so driver signing can be customized (certificate selection, digest, timestamping, extra operands), and adjusts packaging to stage artifacts in a fresh directory and assemble the final package folder last—preventing stale signing artifacts from persisting across rebuilds.

Changes:

• Add --signtool-args to the CLI and plumb it through to signtool sign invocation.
• Rework packaging to build in a clean per-build staging directory and rename into the final package folder at the end (fixes stale cert artifact scenarios).
• Expand integration/unit tests and documentation to cover the new signing behavior and staging semantics.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
crates/cargo-wdk/tests/build_command_test.rs	Adds regression + functional integration tests for staging behavior and --signtool-args.
crates/cargo-wdk/src/providers/mod.rs	Extends filesystem error enum to cover directory removal failures.
crates/cargo-wdk/src/providers/fs.rs	Adds remove_dir_all wrapper to the FS provider for testable directory cleanup.
crates/cargo-wdk/src/cli.rs	Introduces --signtool-args and validates signing flag combinations via TryFrom<&BuildArgs> for SignMode.
crates/cargo-wdk/src/actions/build/tests.rs	Updates build action unit test expectations for staging-dir + final assembly flow and new SignMode shape.
crates/cargo-wdk/src/actions/build/package_task.rs	Implements staging directory flow, package folder assembly, signtool argument tokenization + passthrough, and updates signing behavior.
crates/cargo-wdk/src/actions/build/mod.rs	Adjusts BuildAction to clone SignMode (now contains owned data).
crates/cargo-wdk/README.md	Documents --signtool-args, quoting/tokenization rules, and updated signing/staging semantics.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

❌ Patch coverage is 96.48033% with 17 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.18%. Comparing base (afd38a1) to head (6f06ba3).

Files with missing lines	Patch %	Lines
crates/cargo-wdk/src/actions/new/mod.rs	50.00%	7 Missing ⚠️
crates/cargo-wdk/src/actions/build/package_task.rs	98.44%	0 Missing and 4 partials ⚠️
crates/cargo-wdk/src/actions/build/mod.rs	84.21%	2 Missing and 1 partial ⚠️
crates/cargo-wdk/src/cli.rs	98.60%	1 Missing and 1 partial ⚠️
crates/cargo-wdk/src/providers/fs.rs	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #699      +/-   ##
==========================================
+ Coverage   81.06%   82.18%   +1.12%     
==========================================
  Files          26       25       -1     
  Lines        5899     6287     +388     
  Branches     5899     6287     +388     
==========================================
+ Hits         4782     5167     +385     
  Misses        989      989              
- Partials      128      131       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

🟡 Changes recommended

There’s an unaddressed behavior/UX gap around default signing options (notably timestamping) and documentation clarity that should be resolved before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (2)

crates/cargo-wdk/README.md:126

• The docs imply that any use of --signtool-args switches cargo-wdk into full passthrough mode, but the implementation treats an empty/whitespace value as “no args” (i.e., it falls back to the default WDR test-cert signing). Documenting this explicitly helps avoid surprises when users pass an env var that expands to an empty string.

- When `--signtool-args` is **omitted**, cargo-wdk signs with the auto-generated WDR test certificate as described above.
- When `--signtool-args` is **provided**, you own the full `signtool sign` option set (certificate selection, digest algorithm, etc.). `cargo-wdk` will prepend the `sign` verb to your arguments and append the trailing file operand so you should not provide them.

`--signtool-args` applies only when signing is enabled; supplying it with `--sign-mode=off` is an error.

crates/cargo-wdk/src/actions/build/package_task.rs:308

• The default (non-passthrough) signtool sign argument list no longer includes any timestamping option (e.g. /t or /tr). Without timestamping, signatures can become invalid after the signing certificate expires, which is a potentially significant behavior change for produced artifacts. Consider either restoring a default timestamp switch (as previously used) or explicitly documenting that timestamping is left to the caller via --signtool-args.

                WDR_TEST_CERT_STORE,
                "/n",
                WDR_LOCAL_TEST_CERT,
                "/fd",
                "SHA256",

• Files reviewed: 14/14 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

crates/cargo-wdk/tests/build_command_test.rs:588

• This assertion still uses the previous generic error substring ("signing driver binary"), but the new error path reports failures as "Error signing using signtool". Using the updated substring will keep the test aligned with current error formatting while still allowing signtool-version differences.

            assert!(
                stderr.contains("No file digest algorithm specified")
                    || stderr.contains("signing driver binary"),
                "expected a signtool failure from the duplicate `sign` verb, got: {stderr}"
            );

crates/cargo-wdk/README.md:126

• Docs say that when --signtool-args is provided, the caller owns the full signtool sign option set. However, the CLI parser treats empty/whitespace values as "no args" and the build path falls back to the default test-cert switches when the parsed args are empty. Consider documenting that empty/whitespace values are treated the same as omitting the flag to avoid surprising behavior.

To sign with your own certificate or tweak any signing option, pass `--signtool-args` with a string of the arguments to forward to `signtool sign`.

- When `--signtool-args` is **omitted**, cargo-wdk signs with the auto-generated WDR test certificate as described above.
- When `--signtool-args` is **provided**, you own the full `signtool sign` option set (certificate selection, digest algorithm, etc.). `cargo-wdk` will prepend the `sign` verb to your arguments and append the trailing file operand so you should not provide them.

`--signtool-args` applies only when signing is enabled; supplying it with `--sign-mode=off` is an error.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

crates/cargo-wdk/src/actions/build/package_task.rs:39

• The default timestamp URL is plain HTTP. That allows MITM tampering with timestamp responses and undermines the integrity guarantees of Authenticode timestamping. Prefer HTTPS for the default TSA endpoint, and update the associated unit tests that hardcode the URL in expected signtool args.

const DEFAULT_TIMESTAMP_URL: &str = "http://timestamp.digicert.com";

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

crates/cargo-wdk/src/cli.rs:195

• The PR description says that when --signtool-args is provided, the caller owns the full signtool sign option set. However, --signtool-args '' / whitespace currently parses to an empty vector and is treated the same as omitting the flag (default test cert + default switches). If that’s not intended, reject an explicitly-provided-but-empty value so the behavior matches the documented contract.

            SignModeArg::Test => Ok(SignMode::Test {
                verify_signature: self.verify_signature,
                signtool_args: self
                    .signtool_args
                    .clone()
                    .map(|parsed| parsed.0)
                    .unwrap_or_default(),
            }),

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (1)

crates/cargo-wdk/src/actions/build/package_task.rs:956

• The mock expectation compares args (a &[&str] from run_with_redaction) directly to expected (Vec<String>). This won’t compile because the slice of &str can’t be compared to Vec<String>.

Convert the received args slice to Vec<String> (or change expected to Vec<&str>) before comparing so the test builds and correctly asserts the forwarded argument list.

        fn expect_signtool_args(
            expected: Vec<String>,
            expected_redaction_indices: Vec<usize>,
        ) -> CommandExec {
            let mut command_exec = CommandExec::default();
            command_exec
                .expect_run_with_redaction()
                .withf(move |command, args, redaction_indices, _env, _cwd| {
                    command == "signtool"
                        && args == expected
                        && redaction_indices == expected_redaction_indices.as_slice()
                })

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

crates/cargo-wdk/src/cli.rs:195

• --signtool-args is documented/positioned as supplying the arguments to signtool sign excluding the sign verb (cargo-wdk prepends it), but the CLI layer currently accepts a leading sign token and only fails later with a confusing signtool error. This contradicts the stated contract and makes user mistakes hard to diagnose; reject a leading sign (case-insensitive) during argument validation with a clear clap error.

            SignModeArg::Test => Ok(SignMode::Test {
                verify_signature: self.verify_signature,
                signtool_args: self
                    .signtool_args
                    .clone()

crates/cargo-wdk/src/providers/exec.rs:80

• run_with_redaction uses assert! to validate redaction_indices. If an out-of-bounds index is ever computed (e.g., by future callers), this will panic and crash the CLI instead of producing a regular error. It’s safer to treat invalid indices as a non-fatal internal condition (e.g., filter them out and keep a debug-only assertion).

        assert!(
            redaction_indices.iter().all(|&i| i < args.len()),
            "redaction index out of bounds for {} argument(s): {redaction_indices:?}",
            args.len()
        );