Current, the pkgtools allows the users to set digest and/or certificate without setting manifest file when creating csar. This shouldn't be allowed because digest and signing information would be added to manifest file.