feat(cargo-wdk): add --signtool-args passthrough to customize driver signing

crates/cargo-wdk/README.md

@@ -71,6 +71,11 @@ Options:
       --locked                     Assert that `Cargo.lock` will remain unchanged
   -h, --help                       Print help
 
+Driver Signing:
+      --signtool-args <ARGS>       Additional arguments forwarded verbatim to
+                                   `signtool sign`, as a single quoted string
+                                   (e.g. `--signtool-args "/fd SHA256 /f cert.pfx"`)
+
 Feature Selection:
       --all-features               Activate all available features
       --no-default-features        Do not activate the `default` feature
@@ -106,6 +111,21 @@ If the `--verify-signature` flag is provided, the signatures are verified after
 
 `--verify-signature` cannot be combined with `--sign-mode=off` because if signing is off there is nothing to verify. Passing both will cause `build` to fail with an error.
 
+##### Customizing signtool arguments
+
+By default test signing uses the auto-generated `WDRLocalTestCert` certificate and cargo-wdk's default switches (`sign /v /s WDRTestCertStore /n WDRLocalTestCert /fd SHA256 <file>`). If you need to sign with your own certificate or tweak any signing option, pass `--signtool-args` with a single quoted string of the arguments you want forwarded to `signtool sign`.
+
+- When `--signtool-args` is **omitted**, cargo-wdk signs with the auto-generated WDR test certificate as described above.
+- When `--signtool-args` is **provided**, you own the full `signtool sign` option set (certificate selection, digest algorithm, etc.). cargo-wdk only wraps your arguments with the `sign` verb and the trailing file operand. If your arguments don't include a certificate selector (e.g. `/n`, `/s`, `/f`, `/sha1`), `signtool` auto-selects a code-signing certificate from your personal store and fails if none — or more than one — is found.
+
+The string is split into individual arguments on whitespace, honoring single- and double-quoted spans so values containing spaces (e.g. `/n "CN=Contoso Root"`) survive as a single argument. Any shell-level quoting/escaping is your responsibility and is applied by the shell before cargo-wdk sees the value.
+
+`--signtool-args` applies only when signing (i.e. `--sign-mode=test`); supplying it with `--sign-mode=off` is an error.
+
+Consistent with the WDK MSBuild `TestSign` target, the default test signing does **not** timestamp the signature (no `/t`, `/tr`, or `/td` switches). If you require timestamping, add the relevant switches through `--signtool-args`.
+
+If signing fails, the package folder is assembled only after signing succeeds, so a failure never leaves unsigned output in the package directory.
+
 #### Examples
 
 - To build a driver project with default options, navigate to the root of the project and run:
@@ -131,3 +151,15 @@ If the `--verify-signature` flag is provided, the signatures are verified after
     ```pwsh
     cargo wdk build --sign-mode off
     ```
+
+- To test-sign with a certificate selected from a store by subject name, run:
+
+    ```pwsh
+    cargo wdk build --signtool-args "/s MyStore /n MyCert /fd SHA256"
+    ```
+
+- To test-sign with a PFX file whose password is supplied inline, run:
+
+    ```pwsh
+    cargo wdk build --signtool-args "/f C:\certs\my.pfx /p <password> /fd SHA256"
+    ```

crates/cargo-wdk/src/actions/build/mod.rs

@@ -99,7 +99,7 @@ impl<'a> BuildAction<'a> {
             working_dir: absolute(params.working_dir)?,
             profile: params.profile,
             target_arch: params.target_arch,
-            sign_mode: params.sign_mode,
+            sign_mode: params.sign_mode.clone(),
             is_sample_class: params.is_sample_class,
             locked: params.locked,
             features: params.features,
@@ -404,7 +404,7 @@ impl<'a> BuildAction<'a> {
                 working_dir,
                 target_dir: &target_dir,
                 target_arch: &target_arch,
-                sign_mode: self.sign_mode,
+                sign_mode: self.sign_mode.clone(),
                 sample_class: self.is_sample_class,
                 driver_model,
             },