feat(cargo-wdk): add --signtool-args passthrough to customize driver signing

crates/cargo-wdk/README.md

@@ -63,20 +63,28 @@ The last component of `PATH` is used as the name of the crate.
 Usage: cargo wdk build [OPTIONS]
 
 Options:
-      --profile <PROFILE>          Build artifacts with the specified profile
-      --target-arch <TARGET_ARCH>  Build for the target architecture
+      --profile <PROFILE>
+          Build artifacts with the specified profile
+      --target-arch <TARGET_ARCH>
+          Build for the target architecture
       --target-platform <TARGET_PLATFORM>
-                                   Driver target platform [default: universal] [possible values: desktop, universal, windows]
-      --sample                     Build sample class driver project
-      --sign-mode <SIGN_MODE>      Driver signing mode [default: test] [possible values: off, test]
-      --verify-signature           Verify the signature
-      --locked                     Assert that `Cargo.lock` will remain unchanged
-  -h, --help                       Print help
+          Driver target platform [default: universal] [possible values: universal, desktop, windows]
+      --sample
+          Build sample class driver project
+      --locked
+          Assert that `Cargo.lock` will remain unchanged
+  -h, --help
+          Print help (see more with '--help')
+
+Driver Signing:
+      --sign-mode <SIGN_MODE>  Signing mode [default: test] [possible values: off, test]
+      --signtool-args <ARGS>   Custom arguments to pass to `signtool sign` when signing the driver binary and the catalog file, e.g. `--signtool-args '/fd SHA512 /n "CN=WDRLocalTestCert, O=Foo"'`
+      --verify-signature       Verify the signatures of the driver binary and catalog file after signing
 
 Feature Selection:
-      --all-features               Activate all available features
-      --no-default-features        Do not activate the `default` feature
-  -F, --features <FEATURES>        Space-separated list of features to activate
+      --all-features         Activate all available features
+      --no-default-features  Do not activate the `default` feature
+  -F, --features <FEATURES>  Space-separated list of features to activate
 
 Verbosity:
   -v, --verbose...  Increase logging verbosity
@@ -108,6 +116,15 @@ If the `--verify-signature` flag is provided, the signatures are verified after
 
 `--verify-signature` cannot be combined with `--sign-mode=off` because if signing is off there is nothing to verify. Passing both will cause `build` to fail with an error.
 
+##### Customizing signtool arguments
+
+To sign with your own certificate or tweak any signing option, pass `--signtool-args` with a string of the arguments to forward to `signtool sign`.
+
+- When `--signtool-args` is **omitted**, cargo-wdk signs with the auto-generated WDR test certificate as described above.
+- When `--signtool-args` is **provided**, you own the full `signtool sign` option set (certificate selection, digest algorithm, etc.). `cargo-wdk` will prepend the `sign` verb to your arguments and append the trailing file operand so you should not provide them.
+
+`--signtool-args` applies only when signing is enabled; supplying it with `--sign-mode=off` is an error.
+
 #### Examples
 
 - To build a driver project with default options, navigate to the root of the project and run:

crates/cargo-wdk/src/actions/build/build_task.rs

@@ -14,14 +14,10 @@ use mockall_double::double;
 use tracing::debug;
 use wdk_build::CpuArchitecture;
 
-use super::features_to_cargo_args;
+use super::{Profile, error::BuildTaskError, features_to_cargo_args, to_target_triple};
 #[double]
 use crate::providers::exec::CommandExec;
-use crate::{
-    actions::{Profile, build::error::BuildTaskError, to_target_triple},
-    providers::error::CommandError,
-    trace,
-};
+use crate::{providers::error::CommandError, trace};
 
 /// Parameters for constructing a [`BuildTask`].
 pub struct BuildTaskParams<'a> {
@@ -156,7 +152,7 @@ mod tests {
 
     use super::*;
     use crate::{
-        actions::Profile,
+        actions::build::Profile,
         providers::{error::CommandError, exec::MockCommandExec},
     };
 

crates/cargo-wdk/src/actions/build/error.rs

@@ -76,8 +76,12 @@ pub enum PackageTaskError {
     CertGenerationInStoreCommand(#[source] CommandError),
     #[error("Error while acquiring mutex for generating certificate. HRESULT: {0:#x}")]
     CertMutexError(i32),
-    #[error("Error signing driver binary using signtool")]
-    DriverBinarySignCommand(#[source] CommandError),
+    #[error("Error signing {} using signtool", .file.display())]
+    SigntoolSignCommand {
+        file: PathBuf,
+        #[source]
+        source: CommandError,
+    },
     #[error("Error verifying signed driver binary using signtool")]
     DriverBinarySignVerificationCommand(#[source] CommandError),
     #[error("Error verifying inf file using infverif")]

crates/cargo-wdk/src/actions/build/mod.rs

@@ -13,8 +13,10 @@ mod package_task;
 #[cfg(test)]
 mod tests;
 use std::{
+    fmt::{self, Display},
     path::{Path, PathBuf, absolute},
     result::Result::Ok,
+    str::FromStr,
 };
 
 use anyhow::Result;
@@ -31,10 +33,49 @@ use wdk_build::{
     metadata::{TryFromCargoMetadataError, Wdk},
 };
 
-use crate::actions::Profile;
 #[double]
 use crate::providers::{exec::CommandExec, fs::Fs, metadata::Metadata, wdk_build::WdkBuild};
 
+/// `x86_64/Amd64` target triple name
+const X86_64_TARGET_TRIPLE_NAME: &str = "x86_64-pc-windows-msvc";
+/// `aarch64/Arm64` target triple name
+const AARCH64_TARGET_TRIPLE_NAME: &str = "aarch64-pc-windows-msvc";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Profile {
+    Dev,
+    Release,
+}
+impl FromStr for Profile {
+    type Err = String;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s.to_lowercase().as_str() {
+            "dev" => Ok(Self::Dev),
+            "release" => Ok(Self::Release),
+            _ => Err(format!("'{s}' is not a valid profile")),
+        }
+    }
+}
+impl Display for Profile {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let s = match self {
+            Self::Dev => "dev",
+            Self::Release => "release",
+        };
+        write!(f, "{s}")
+    }
+}
+
+/// Converts `CpuArchitecture` to its corresponding target triple name.
+#[must_use]
+pub fn to_target_triple(cpu_arch: CpuArchitecture) -> String {
+    match cpu_arch {
+        CpuArchitecture::Amd64 => X86_64_TARGET_TRIPLE_NAME.to_string(),
+        CpuArchitecture::Arm64 => AARCH64_TARGET_TRIPLE_NAME.to_string(),
+    }
+}
+
 pub struct BuildActionParams<'a> {
     pub working_dir: &'a Path,
     pub profile: Option<&'a Profile>,
@@ -101,7 +142,7 @@ impl<'a> BuildAction<'a> {
             working_dir: absolute(params.working_dir)?,
             profile: params.profile,
             target_arch: params.target_arch,
-            sign_mode: params.sign_mode,
+            sign_mode: params.sign_mode.clone(),
             is_sample_class: params.is_sample_class,
             locked: params.locked,
             target_platform: params.target_platform,
@@ -407,7 +448,7 @@ impl<'a> BuildAction<'a> {
                 working_dir,
                 target_dir: &target_dir,
                 target_arch: &target_arch,
-                sign_mode: self.sign_mode,
+                sign_mode: self.sign_mode.clone(),
                 sample_class: self.is_sample_class,
                 driver_model,
                 target_platform: self.target_platform,