  def add_file_signed name, mode, signer
    digest_algorithms = [
      signer.digest_algorithm,
      Digest::SHA512,
    ].compact.uniq

    digests = add_file_digest name, mode, digest_algorithms do |io|
      yield io
    end

    signature_digest = digests.values.compact.find do |digest|
      digest_name =
        if digest.respond_to? :name then
          digest.name
        else
          /::([^:]+)$/ =~ digest.class.name
          $1
        end

      digest_name == signer.digest_name
    end

    raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest

    if signer.key then
      signature = signer.sign signature_digest.digest

      add_file_simple "#{name}.sig", 0444, signature.length do |io|
        io.write signature
      end
    end

    digests
  end
The software does not verify, or incorrectly verifies, the cryptographic signature for data.