}

    // Signing modes: optional vs enforced
    @Test
    @DisplayName("isSigningOptional and isSigningEnforced reflect configuration")
    void signingModes() throws Exception {
        when(transport.isSigningOptional()).thenReturn(true);
        when(transport.isSigningEnforced()).thenReturn(false);

        assertTrue(transport.isSigningOptional());
        assertFalse(transport.isSigningEnforced());

        // Enforced via constructor flag -> optional false, enforced true regardless of negotiation
        SmbTransportImpl enforced = new SmbTransportImpl(ctx, address, 445, null, 0, true);
        assertFalse(enforced.isSigningOptional());
        assertTrue(enforced.isSigningEnforced());

        // Negotiated required -> enforced true; negotiated enabled-only -> optional true
        SmbNegotiationResponse nego = mock(SmbNegotiationResponse.class);

            final SmbTransportInternal trans, final SmbTreeImpl t, final DfsReferralData referral) throws CIFSException {
        if (log.isDebugEnabled() && trans.isSigningOptional() && !loc.isIPC() && !this.ctx.getConfig().isSigningEnforced()) {
            log.debug("Signatures for file enabled but not required " + this);
        }

        if (referral != null) {