code: func (p *Package) Sign(cert tls.Certificate, wwdr *x509.Certificate) error {
  	if p.err != nil {
  		return p.err
  	}
  
  	// assert that private key is RSA
  	key, ok := cert.PrivateKey.(*rsa.PrivateKey)
  	if !ok {
  		return errors.New("expected RSA private key type")
  	}
  
  	manifestBytes, err := json.Marshal(p.manifest)
  	if err != nil {
  		return err
  	}
  
  	zf, err := p.z.Create("manifest.json")
  	if err != nil {
  		return err
  	}
  	zf.Write(manifestBytes)
  
  	// sign manifest.json with PKCS #7
  	// and add signature to the zip file
  	zf, err = p.z.Create("signature")
  	if err != nil {
  		return err
  	}
  	sig, err := pkcs7.Sign2(bytes.NewReader(manifestBytes), cert.Leaf, key, wwdr)
  	if err != nil {
  		return err
  	}
  	zf.Write(sig)
  
  	return p.z.Close()
  }
docs: // Sign the package and close.
  // Passbook needs Apple's intermediate WWDR certificate.