feat: introduce sign mode for driver packaging, allowing skipping of signing steps

[svasista-ms]

This PR adds a --sign-mode option to the cargo wdk build command that lets you turn off test signing which is useful for production/HLK scenarios.

Resolves #588

Functionality

--sign-mode takes two values:

• test: generates a self-signed cert and signs artifacts with it. Same behavior as today
• off: skips all signing including cert generation

test is the default so if --sign-mode is omitted the command behaves exactly as today and thus remains backwards compatible.

An error is returned if you try to use --verify-signature with --sign-mode=off because verification does not make sense when nothing is signed.

Future Direction

This PR is part of a broader goal to replicate Visual Studio's SignMode setting in cargo-wdk. In the future we plan to:

• Introduce a third --sign-mode value called prod to enable a production signing mode that will not generate a test cert and will instead require a user-specified cert
• Add CLI options for specifying certs, timestamp servers and signing algorithms

Changes

• New sign_mode field in BuildArgs [1]
• CLI-layer logic to reject use of --verify-signature with --sign-mode=off [2]
• New SignMode enum with Test and Off variants [3].
• Plumbed SignMode from BuildAction through PackageTask
• In PackageTask::run(), gated generate_certificate, the certificate copy and signtool invocations on SignMode::Test[4]
• Unit tests for the new paths [5]
• Integration tests [6]

Screenshots

cargo wdk build --help showing --sign-mode:

Building with --sign-mode=off:

Building with --sign-mode=test:

Building without the --sign-mode option -- falls back to the default (test) behavior:

Error when using --verify-signature with --sign-mode=off:

[Copilot]

Pull request overview

Adds a new build-time signing mode to cargo-wdk so production packaging can skip test-signing (and associated certificate generation/verification), aligning with the request in #588 to produce unsigned driver binaries for external signing.

Changes:

• Introduces SignMode (test default, off) and wires it through CLI → BuildAction → PackageTask.
• Updates packaging flow to conditionally skip certificate generation, signtool signing, and signature verification when --sign-mode=off.
• Adds unit + integration tests covering --sign-mode=off, CLI validation, and help-surface expectations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
crates/cargo-wdk/tests/build_command_test.rs	Adds integration tests for --sign-mode=off, including “not Authenticode signed” validation.
crates/cargo-wdk/src/cli.rs	Adds --sign-mode flag, passes it into build params, and rejects --verify-signature with --sign-mode=off.
crates/cargo-wdk/src/actions/mod.rs	Defines the SignMode enum with parsing/display behavior.
crates/cargo-wdk/src/actions/build/tests.rs	Extends build action tests/mocks to cover sign-mode off behavior and propagation.
crates/cargo-wdk/src/actions/build/package_task.rs	Implements sign-mode branching in packaging, skipping signing steps when off.
crates/cargo-wdk/src/actions/build/mod.rs	Threads sign_mode from build action into package task params.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.61%. Comparing base (74b1da7) to head (d536fd8).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #649      +/-   ##
==========================================
+ Coverage   79.45%   79.61%   +0.16%     
==========================================
  Files          26       26              
  Lines        5500     5544      +44     
  Branches     5500     5544      +44     
==========================================
+ Hits         4370     4414      +44     
  Misses       1001     1001              
  Partials      129      129              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[gurry]

It's odd that we're printing the error twice:

Why is that? Is this true for other errors as well? What can we do to fix it?

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.