Signed link generation

[SantiagoTorres]

Description of issue or feature request: The current implementation can only generate unsigned links for the sake of inspections. Although this is enough to perform verification it is not the complete functionality required for use by functionaries.

Current behavior: There are no library functions to generate and sign in-toto link metadata. (only to run inspections)

Expected behavior: A function or group of functions should be available to generate and sign in-toto link metadata.

[Jigar3]

Hello, I am Jigar and would like to contribute in this project. It would be really helpful if you could point me to some resources which I can read to know more about the project.

Currently found these all resources:

1. https://www.youtube.com/watch?v=05zN-YQxEAM
2. https://github.com/in-toto/docs
3. https://github.com/in-toto/demo

Are there any othes which you might suggest?

[lukpueh]

Thanks for your interest, @Jigar3! in-toto/in-toto#284 provides an overview of available documentation. You can find more talk recordings on the in-toto website (in-toto.io).

I also recommend you to take a look at the runlib module of the in-toto reference implementation, which has the full feature set (in Python), that we want for in-toto-golang. The reference implementation uses securesystemslib as interface to cryptographic primitives.

Let me know if you have any questions!

[Jigar3]

Thanks @lukpueh for providing resources, will definitely look into them and get back to you with any questions I may have.

[shibumi]

Signed Link generation should have been adressed in #56. I think we can close this issue:

@lukpueh @SantiagoTorres