def rsa_pss_sign(private_key, data, hash_algorithm):
if not isinstance(private_key, PrivateKey):<EOL><INDENT>raise TypeError(pretty_message(<EOL>'''<STR_LIT>''',<EOL>type_name(private_key)<EOL>))<EOL><DEDENT>if not isinstance(data, byte_cls):<EOL><INDENT>raise TypeError(pretty_message(<EOL>'''<STR_LIT>''',<EOL>type_name(data)<EOL>))<EOL><DEDENT>if private_key.algorithm != '<STR_LIT>':<EOL><INDENT>raise ValueError('<STR_LIT>')<EOL><DEDENT>hash_length = {<EOL>'<STR_LIT>': <NUM_LIT:20>,<EOL>'<STR_LIT>': <NUM_LIT>,<EOL>'<STR_LIT>': <NUM_LIT:32>,<EOL>'<STR_LIT>': <NUM_LIT>,<EOL>'<STR_LIT>': <NUM_LIT:64><EOL>}.get(hash_algorithm, <NUM_LIT:0>)<EOL>encoded_data = add_pss_padding(hash_algorithm, hash_length, private_key.bit_size, data)<EOL>key_length = private_key.byte_size<EOL>buffer = buffer_from_bytes(key_length)<EOL>output_length = new(Security, '<STR_LIT>', key_length)<EOL>result = Security.SecKeyDecrypt(<EOL>private_key.sec_key_ref,<EOL>SecurityConst.kSecPaddingNone,<EOL>encoded_data,<EOL>len(encoded_data),<EOL>buffer,<EOL>output_length<EOL>)<EOL>handle_sec_error(result)<EOL>return bytes_from_buffer(buffer, deref(output_length))<EOL>
Generates an RSASSA-PSS signature. For the PSS padding the mask gen
algorithm will be mgf1 using the same hash algorithm as the signature. The
salt length with be the length of the hash algorithm, and the trailer field
with be the standard 0xBC byte.

:param private_key:
    The PrivateKey to generate the signature with

:param data:
    A byte string of the data the signature is for

:param hash_algorithm:
    A unicode string of "md5", "sha1", "sha224", "sha256", "sha384" or
    "sha512"

:raises:
    ValueError - when any of the parameters contain an invalid value
    TypeError - when any of the parameters are of the wrong type
    OSError - when an error is returned by the OS crypto library

:return:
    A byte string of the signature