diff --git a/crates/cargo-wdk/src/actions/build/package_task.rs b/crates/cargo-wdk/src/actions/build/package_task.rs index 97d20ea54..658c5ac07 100644 --- a/crates/cargo-wdk/src/actions/build/package_task.rs +++ b/crates/cargo-wdk/src/actions/build/package_task.rs @@ -54,7 +54,7 @@ pub enum SignMode { /// certificate and default switches. When non-empty, auto generation /// is skipped and the caller owns the full signtool command line /// (certificate selection, digest, etc.). - signtool_args: Vec, + signtool_args: Option>, }, } @@ -288,25 +288,26 @@ impl<'a> PackageTask<'a> { info!("Sign mode is 'off'; skipping signing"); return Ok(()); }; - let sign_args = if signtool_args.is_empty() { - self.generate_certificate()?; - self.copy(&self.src_cert_file_path, &self.dest_cert_file_path)?; - // Default WDR test-cert switches. - [ - "/v", - "/s", - WDR_TEST_CERT_STORE, - "/n", - WDR_LOCAL_TEST_CERT, - "/t", - DEFAULT_TIMESTAMP_URL, - "/fd", - "SHA256", - ] - .map(ToString::to_string) - .to_vec() - } else { - signtool_args.clone() + let sign_args = match signtool_args { + Some(args) if !args.is_empty() => args.clone(), + _ => { + self.generate_certificate()?; + self.copy(&self.src_cert_file_path, &self.dest_cert_file_path)?; + // Default WDR test-cert switches. + [ + "/v", + "/s", + WDR_TEST_CERT_STORE, + "/n", + WDR_LOCAL_TEST_CERT, + "/t", + DEFAULT_TIMESTAMP_URL, + "/fd", + "SHA256", + ] + .map(ToString::to_string) + .to_vec() + } }; self.run_signtool_sign(&self.dest_driver_binary_path, &sign_args)?; self.run_signtool_sign(&self.dest_cat_file_path, &sign_args)?; @@ -555,17 +556,19 @@ impl<'a> PackageTask<'a> { let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect(); - // Determine the indices of password values (the token right after each - // `/p`) so they can be redacted by `run_with_redaction` in the logs. - // `value_index < file_operand_index` ensures a value token - // actually follows `/p` and that it is never the trailing file operand. + // Determine the indices of password values so they can be redacted by + // `run_with_redaction` in the logs. + // `value_index < file_operand_index` ensures a value token actually + // follows `-p` or `/p` and that it is never the trailing file operand. let file_operand_index = arg_refs.len() - 1; let redaction_indices: Vec = arg_refs .iter() .enumerate() .filter_map(|(i, arg)| { let value_index = i + 1; - (arg.eq_ignore_ascii_case("/p") && value_index < file_operand_index) + (arg.strip_prefix(['-', '/']) + .is_some_and(|arg| arg.eq_ignore_ascii_case("p")) + && value_index < file_operand_index) .then_some(value_index) }) .collect(); @@ -724,7 +727,7 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, inf2cat_args: None, target_platform: TargetPlatform::Universal, @@ -740,7 +743,7 @@ mod tests { task.sign_mode, SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, } ); assert!(!task.sample_class); @@ -793,7 +796,7 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, inf2cat_args: None, target_platform: TargetPlatform::Universal, @@ -824,7 +827,7 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, inf2cat_args: None, target_platform: TargetPlatform::Universal, @@ -864,7 +867,7 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, inf2cat_args: None, target_platform: TargetPlatform::Universal, @@ -922,7 +925,7 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, inf2cat_args: None, target_platform: TargetPlatform::Universal, @@ -967,7 +970,7 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, inf2cat_args: Some(Vec::new()), target_platform: TargetPlatform::Universal, @@ -1009,7 +1012,7 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, inf2cat_args: Some(vec![ "/os:10_x64,10_CO_X64".to_string(), @@ -1182,7 +1185,7 @@ mod tests { "sign", "/f", "cert.pfx", - "/P", + "-P", "secret", "/fd", "SHA256", @@ -1200,7 +1203,7 @@ mod tests { let signtool_args = [ "/f".to_string(), "cert.pfx".to_string(), - "/P".to_string(), + "-P".to_string(), "secret".to_string(), "/fd".to_string(), "SHA256".to_string(), @@ -1260,14 +1263,14 @@ mod tests { sample_class: false, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: vec![ + signtool_args: Some(vec![ "/s".to_string(), "MyStore".to_string(), "/n".to_string(), "MyCert".to_string(), "/fd".to_string(), "SHA256".to_string(), - ], + ]), }, inf2cat_args: None, target_platform: TargetPlatform::Universal, diff --git a/crates/cargo-wdk/src/actions/build/tests.rs b/crates/cargo-wdk/src/actions/build/tests.rs index aa85b9f7a..44f3fd406 100644 --- a/crates/cargo-wdk/src/actions/build/tests.rs +++ b/crates/cargo-wdk/src/actions/build/tests.rs @@ -1841,7 +1841,7 @@ impl TestBuildAction { sample_class, sign_mode: SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, }, locked: false, features: Features::default(), diff --git a/crates/cargo-wdk/src/cli.rs b/crates/cargo-wdk/src/cli.rs index a0d581e78..69b892d3c 100644 --- a/crates/cargo-wdk/src/cli.rs +++ b/crates/cargo-wdk/src/cli.rs @@ -143,6 +143,8 @@ pub struct BuildArgs { #[arg( long, value_name = "ARGS", + // `signtool` args can be `-` prefixed. + allow_hyphen_values = true, value_parser = parse_passthrough_args, help_heading = "Driver Signing" )] @@ -198,11 +200,7 @@ impl BuildArgs { } SignModeArg::Test => Ok(SignMode::Test { verify_signature: self.verify_signature, - signtool_args: self - .signtool_args - .clone() - .map(|parsed| parsed.0) - .unwrap_or_default(), + signtool_args: self.signtool_args.clone().map(|parsed| parsed.0), }), } } @@ -514,7 +512,7 @@ mod tests { args.sign_mode().expect("mapping should succeed"), SignMode::Test { verify_signature: false, - signtool_args: Vec::new(), + signtool_args: None, } ); } @@ -527,7 +525,7 @@ mod tests { args.sign_mode().expect("mapping should succeed"), SignMode::Test { verify_signature: true, - signtool_args: vec!["/fd".to_string(), "SHA256".to_string()], + signtool_args: Some(vec!["/fd".to_string(), "SHA256".to_string()]), } ); } diff --git a/crates/cargo-wdk/tests/build_command_test.rs b/crates/cargo-wdk/tests/build_command_test.rs index 66c6ce897..a835e9f00 100644 --- a/crates/cargo-wdk/tests/build_command_test.rs +++ b/crates/cargo-wdk/tests/build_command_test.rs @@ -470,7 +470,7 @@ mod signtool_args { &project_path, Some(&[ "--signtool-args", - "/s WDRCustomTestStore /n WDRCustomTestCert /fd SHA256", + "-s WDRCustomTestStore /n WDRCustomTestCert -fd SHA256", ]), None, );