Function sign_manifest_document 

pub fn sign_manifest_document(
    manifest_toml: &str,
    pkcs8_der: &[u8],
) -> Result<String, PluginError>

Sign a manifest and return the signed document, with the root signature and publisher_key entries embedded.

This is the publisher-side inverse of canonical_manifest_bytes. The entries are placed in the document before it is signed, so the signed bytes are exactly what the host reconstructs when it removes them again.

Embedding by hand after sign_manifest is equivalent only while nothing that was signed moves. The TOML editor the host canonicalizes with attaches a blank line or comment to the entry or table header below it. Entries inserted directly under decoration that was already in the signed manifest take it with them when the host removes them, and decoration added below the entries attaches to the next signed item. Either way the signature no longer verifies.

Root signature and publisher_key entries already present are replaced.