Merge branch 'main' into derives-library

Signed-off-by: Leon Durrenberger <leon.durrenberger@gmail.com>

Author: leon-xd

.github/actions/install-winget/action.yaml

@@ -80,15 +80,16 @@ runs:
           # Install all dependency packages for the detected architecture
           $depsInstalled = 0
           $depsFailed = 0
-          Get-ChildItem -Path $depsDir -Recurse -Include '*.appx', '*.msix' | Where-Object {
+          $depPackages = Get-ChildItem -Path $depsDir -Recurse -Include '*.appx', '*.msix' | Where-Object {
             $_.FullName -match "[\\/]$arch[\\/]"
-          } | ForEach-Object {
+          }
+          foreach ($pkg in $depPackages) {
             try {
-              Add-AppxPackage -Path $_.FullName -ForceApplicationShutdown -ForceUpdateFromAnyVersion -ErrorAction Stop
-              Write-Host "Installed dependency: $($_.Name)"
+              Add-AppxPackage -Path $pkg.FullName -ForceApplicationShutdown -ForceUpdateFromAnyVersion -ErrorAction Stop
+              Write-Host "Installed dependency: $($pkg.Name)"
               $depsInstalled++
             } catch {
-              Write-Host "Dependency $($_.Name): $($_.Exception.Message)"
+              Write-Host "Dependency $($pkg.Name): $($_.Exception.Message)"
               $depsFailed++
             }
           }

.github/workflows/build.yaml

@@ -113,9 +113,9 @@ jobs:
         run: cargo +${{ matrix.rust_toolchain }} install --path=crates/cargo-wdk --profile ${{ matrix.cargo_profile }} --locked --force
 
       - name: Build & Package Examples (via cargo-wdk)
-        run: cargo +${{ matrix.rust_toolchain }} wdk build --profile ${{ matrix.cargo_profile }} --target-arch ${{ matrix.target_triple.arch }} --sample
+        run: cargo +${{ matrix.rust_toolchain }} wdk build --locked --profile ${{ matrix.cargo_profile }} --target-arch ${{ matrix.target_triple.arch }} --sample
         working-directory: ./examples
 
       - name: Run build on tests folder (via cargo-wdk)
-        run: cargo +${{ matrix.rust_toolchain }} wdk build --profile ${{ matrix.cargo_profile }} --target-arch ${{ matrix.target_triple.arch }}
+        run: cargo +${{ matrix.rust_toolchain }} wdk build --locked --profile ${{ matrix.cargo_profile }} --target-arch ${{ matrix.target_triple.arch }}
         working-directory: ./tests

.github/workflows/test.yaml

@@ -108,7 +108,7 @@ jobs:
 
       - name: Upload Coverage to Codecov
         if: matrix.runner.arch != 'arm64' && github.repository == 'microsoft/windows-drivers-rs' # Skip for forks because they may not have CODECOV_TOKEN
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           files: target/codecov.info
           token: ${{ secrets.CODECOV_TOKEN }}

Cargo.lock

@@ -39,7 +39,6 @@ anyhow = "1.0.97"
 assert_cmd = "2.0.17"
 assert_fs = "1.1.3"
 bindgen = "0.72.1"
-bitflags = "2.6.0"
 camino = "1.1.9"
 cargo_metadata = "0.19.2"
 cc = "1.2.39"

Cargo.toml

@@ -14,7 +14,7 @@ version = "0.1.1"
 anyhow.workspace = true
 cargo_metadata.workspace = true
 clap = { features = ["derive"], workspace = true }
-clap-cargo.workspace = true
+clap-cargo = { features = ["cargo_metadata"], workspace = true }
 clap-verbosity-flag.workspace = true
 include_dir.workspace = true
 mockall.workspace = true

crates/cargo-wdk/Cargo.toml

@@ -65,16 +65,23 @@ Usage: cargo wdk build [OPTIONS]
 Options:
       --profile <PROFILE>          Build artifacts with the specified profile
       --target-arch <TARGET_ARCH>  Build for the target architecture
+      --sign-mode <SIGN_MODE>      Driver signing mode [default: test] [possible values: off, test]
       --verify-signature           Verify the signature
       --sample                     Build sample class driver project
+      --locked                     Assert that `Cargo.lock` will remain unchanged
   -h, --help                       Print help
 
+Feature Selection:
+      --all-features               Activate all available features
+      --no-default-features        Do not activate the `default` feature
+  -F, --features <FEATURES>        Space-separated list of features to activate
+
 Verbosity:
   -v, --verbose...  Increase logging verbosity
   -q, --quiet...    Decrease logging verbosity
 ```
 
-`build` takes a number of inputs specifying build profile (`dev` or `release`), target architecture (`amd64` or `arm64`), a flag enabling signature verification and a flag indicating a sample driver along with verbosity flags.
+`build` takes a number of inputs specifying build profile (`dev` or `release`), target architecture (`amd64` or `arm64`), the driver signing mode, a flag enabling signature verification and a flag indicating a sample driver along with verbosity flags.
 
 When the command completes the packaged driver artifacts are emitted at the path `target\<profile>\<project-name>-package`.
 
@@ -90,9 +97,14 @@ If you have a workspace with a mix of sample and non-sample driver projects, the
 
 #### Signing and Verification
 
-To sign driver artifacts `build` looks for a certificate called `WDRLocalTestCert` in a store called `WDRTestCertStore`. Make sure you place your signing certificate there with that name. If no certificate is found, `build` will automatically generate a new self-signed one and add it for you.
+The `build` command has a `--sign-mode` flag that controls how driver artifacts are signed. It accepts the following values:
+
+- `test` (default): Sign with a test certificate. The command looks for a certificate called `WDRLocalTestCert` in a store called `WDRTestCertStore`. If you wish to use your own certificate, add it to the same store with the same name. Otherwise a self-signed certificate will be automatically generated, added, and used for signing.
+- `off`: Skip signing entirely. This is useful when you intend to sign the artifacts later with your own toolchain.
 
-If the `--verify-signature` flag is provided, the signatures are verified after signing. For verification to work, make sure you add a copy of the signing certificate in the `Trusted Root Certification Authorities` store. For security reasons `build` does not automatically do this even when it automatically generates the cert. You will have to always perform this step manually. 
+If the `--verify-signature` flag is provided, the signatures are verified after signing. For verification to work, make sure you add a copy of the signing certificate in the `Trusted Root Certification Authorities` store. For security reasons `build` does not automatically do this even when it automatically generates the cert. You will have to always perform this step manually.
+
+`--verify-signature` cannot be combined with `--sign-mode=off` because if signing is off there is nothing to verify. Passing both will cause `build` to fail with an error.
 
 #### Examples
 
@@ -113,3 +125,9 @@ If the `--verify-signature` flag is provided, the signatures are verified after
     ```pwsh
     cargo wdk build --target-arch amd64
     ```
+
+- To build a driver project with signing off, navigate to the root of the project and run:
+
+    ```pwsh
+    cargo wdk build --sign-mode off
+    ```