Function add_snp_id_block_signed 

pub fn add_snp_id_block_signed(
    igvm_data: &[u8],
    signing_payload: &[u8],
    signature_der: &[u8],
    public_key_pem: &[u8],
) -> Result<Vec<u8>>

Add an SNP ID block using an out-of-band signature (production).

signing_payload is the <base>-snp.idblock emitted by manifest (raw [SnpPspIdBlock], see id_block_signing_payload); signature_der is the DER-encoded ECDSA signature a file-content signer produced over those exact bytes; public_key_pem is the signer’s public key as an X.509 certificate or SPKI public key (PEM or DER). The payload’s launch digest and policy are checked against the IGVM file being patched, and the signature is cryptographically verified over the payload bytes with the supplied public key, so that a stale payload, wrong key, or corrupt signature fails at build time rather than only when the guest fails to launch on real hardware.

Errors

Returns an error if the file has no SEV-SNP platform, already contains an SNP ID block, lacks an SNP measurement/guest policy, if the signing payload is malformed or does not match the file, if the signature/public key cannot be parsed, or if the signature does not verify.