code: function signManifest(template, manifest, callback) {
    var identifier = template.passTypeIdentifier().replace(/^pass./, "");
  
    var args = [
      "smime",
      "-sign", "-binary",
      "-signer",    Path.resolve(template.keysPath, identifier + ".pem"),
      "-certfile",  Path.resolve(template.keysPath, "wwdr.pem"),
      "-passin",    "pass:" + template.password
    ];
    var sign = execFile("openssl", args, { stdio: "pipe" }, function(error, stdout, stderr) {
      var trimmedStderr = stderr.trim();
      // Windows outputs some unhelpful error messages, but still produces a valid signature
      if (error || (trimmedStderr && trimmedStderr.indexOf('- done') < 0)) {
        callback(new Error(stderr));
      } else {
        var signature = stdout.split(/(\r\n|\n\n)/)[3];
        callback(null, Buffer.from(signature, "base64"));
      }
    });
    sign.stdin.write(manifest);
    sign.stdin.end();
  }
docs: Signs a manifest and returns the signature.