add options for signing a profile (#602)

pkg/crypto/profileutil/sign.go

@@ -0,0 +1,25 @@
+// Package profileutil signs configuration profiles.
+package profileutil
+
+import (
+	"crypto"
+	"crypto/x509"
+
+	"github.com/fullsailor/pkcs7"
+	"github.com/pkg/errors"
+)
+
+// Sign takes an unsigned payload and signs it with the provided private key and certificate.
+func Sign(key crypto.PrivateKey, cert *x509.Certificate, mobileconfig []byte) ([]byte, error) {
+	sd, err := pkcs7.NewSignedData(mobileconfig)
+	if err != nil {
+		return nil, errors.Wrap(err, "create signed data for mobileconfig")
+	}
+
+	if err := sd.AddSigner(cert, key, pkcs7.SignerInfoConfig{}); err != nil {
+		return nil, errors.Wrap(err, "add crypto signer to mobileconfig signed data")
+	}
+
+	signedMobileconfig, err := sd.Finish()
+	return signedMobileconfig, errors.Wrap(err, "complete mobileconfig signing")
+}