Coordinator API - endpoint for manifest signature

[fnerdman]

Proposed changes

• enhance the Coordinator API manifest endpoint to return the manifests ECDSA signature - signed by intermediate key

Related issue

• Coordinator API - endpoint for manifest signature #290

Open Questions

• The ECDSA signature contains a random element, which means that with the current implementation the signature will change upon each request. An attacker who would like to guess the ECDSA key might find this useful. It could be sensible to create the signature only once and store it in the storeWrapper. @m1ghtym0 any preferences?

[fnerdman]

rfc6979 would also be an option to make the signature output deterministic, however, I can not find an implementation in go which is trustworthy.

[daniel-weisse]

Writing the signature to the store seems like the most sensible idea for now.
I would add the generation and writing to store in SetManifest().

[fnerdman]

@daniel-weisse the manifest signature is now deterministic by setting it once and moving it to the store.
I've just now figured out how manifest updates are handled. As the original manifest is never touched - only update logs exist - it doesn't really make sense to sign the manifest with the intermediate key.
I would add another patch that uses the root key for signing the manifest. This would mean manifest updates still can not be verified by key signatures, but I would propose to postpone this issue to another PR.

[fnerdman]

@daniel-weisse Please review

[daniel-weisse]

Thanks for the PR.
Looks good to me, just three small things: