Function signing_payload 

pub fn signing_payload(
    manifest: &Manifest,
    module_sha256: Option<[u8; 32]>,
) -> Vec<u8> 

The exact bytes a manifest’s signature is computed over: the manifest serialised to JSON with its signature field removed, followed by the module hash (when the plugin ships one). Pure and deterministic, so both the signer and the verifier produce identical input.