pub(super) fn build_sign<Rng: RngCore + CryptoRng, KeyRng: RngCore + EntropicRng, R: Runtime>(

    keymgr: &Arc<KeyMgr>,

    pow_manager: &Arc<PowManager<R>>,

    config: &Arc<OnionServiceConfigPublisherView>,

    authorized_clients: Option<&RestrictedDiscoveryKeys>,

    ipt_set: &IptSet,

    period: TimePeriod,

    revision_counter: RevisionCounter,

    rng: &mut Rng,

    key_rng: &mut KeyRng,

    now: SystemTime,

) -> Result<VersionedDescriptor, FatalError> {

    let intro_points = ipt_set

        .ipts

        .iter()

        .map(|ipt_in_set| ipt_in_set.ipt.clone())

        .collect::<Vec<_>>();

    let nickname = &config.nickname;

    let svc_key_spec = HsIdPublicKeySpecifier::new(nickname.clone());

    let hsid = keymgr

        .get::<HsIdKey>(&svc_key_spec)?

        .ok_or_else(|| FatalError::MissingHsIdKeypair(nickname.clone()))?;

    let keystore_selector = Default::default();

    let blind_id_kp = read_blind_id_keypair(keymgr, nickname, period)?

        .ok_or_else(|| internal!("hidden service offline mode not supported"))?;

    let blind_id_key = HsBlindIdKey::from(&blind_id_kp);

    let subcredential = hsid.compute_subcredential(&blind_id_key, period);

    let hs_desc_sign_key_spec = DescSigningKeypairSpecifier::new(nickname.clone(), period);

    let hs_desc_sign = keymgr.get_or_generate::<HsDescSigningKeypair>(

        &hs_desc_sign_key_spec,

        keystore_selector,

        key_rng,

    )?;

    let auth_required = None;

    // TODO(#727): add support for single onion services

    let is_single_onion_service = false;

    // TODO (#955): perhaps the certificates should be read from the keystore, rather than created

    // when building the descriptor. See #1048

    let intro_auth_key_cert_expiry = now + HS_DESC_CERT_LIFETIME_SEC;

    let intro_enc_key_cert_expiry = now + HS_DESC_CERT_LIFETIME_SEC;

    let hs_desc_sign_cert_expiry = now + HS_DESC_CERT_LIFETIME_SEC;

            let auth_clients: Option<Vec<curve25519::PublicKey>> = authorized_clients

                .as_ref()

                .map(|authorized_clients| {

                    if authorized_clients.is_empty() {

                        return Err(internal!("restricted discovery enabled, but no authorized clients?!"));

                    }

                    let auth_clients = authorized_clients

                        .iter()

                        .map(|(nickname, key)| {

                            trace!("encrypting descriptor for client {nickname}");

                            (*key).clone().into()

                        })

                        .collect_vec();

                    Ok(auth_clients)

                })

                .transpose()?;

    if let Some(ref auth_clients) = auth_clients {

        debug!("Encrypting descriptor for {} clients", auth_clients.len());

    }

    let desc_signing_key_cert = create_desc_sign_key_cert(

        &hs_desc_sign.as_ref().verifying_key(),

        &blind_id_kp,

        hs_desc_sign_cert_expiry,

    )

    .map_err(into_bad_api_usage!(

        "failed to sign the descriptor signing key"

    ))?;

    let blind_id_kp = (&blind_id_kp).into();

    let mut desc = HsDescBuilder::default()

        .blinded_id(&blind_id_kp)

        .hs_desc_sign(hs_desc_sign.as_ref())

        .hs_desc_sign_cert(desc_signing_key_cert)

        .create2_formats(CREATE2_FORMATS)

        .auth_required(auth_required)

        .is_single_onion_service(is_single_onion_service)

        .intro_points(&intro_points[..])

        .intro_auth_key_cert_expiry(intro_auth_key_cert_expiry)

        .intro_enc_key_cert_expiry(intro_enc_key_cert_expiry)

        .lifetime(((ipt_set.lifetime.as_secs() / 60) as u16).into())

        .revision_counter(revision_counter)

        .subcredential(subcredential)

        .auth_clients(auth_clients.as_deref());

    cfg_if::cfg_if! {

        if #[cfg(feature = "hs-pow-full")] {

            let pow_params = pow_manager.get_pow_params(period);

            match pow_params {

                Ok(ref pow_params) => {

                    desc = desc.pow_params(Some(pow_params));

                },

                Err(err) => {

                    warn!(?err, "Couldn't get PoW params");

    let desc = desc

        .build_sign(rng)

        .map_err(|e| into_internal!("failed to build descriptor")(e))?;

    Ok(VersionedDescriptor {

        desc,

        revision_counter,

    })

}