chore: make extra signers auditable in dlog metadata

In both IssueMetadata and TransferMetadata, the ExtraSigners
field was typed as []Identity. This created an auditability gap
- any third party with access to the metadata could not resolve
or audit these identities, unlike Issuer, Senders, and Receivers
which already carry full AuditableIdentity (identity + audit info).

- Change ExtraSigners to []*AuditableIdentity in both IssueMetadata
  and TransferMetadata
- Add V3 metadata proto types (IssueMetadataV3, TransferMetadataV3)
  with AuditableIdentity for ExtraSigners and Issuer
- Add ProtocolV3 constant and backward-compatible FromProtos/ToProtos
- Add SetMinProtocolVersion to Validator interface for protocol enforcement
- Add regression tests for V1/V2/V3 metadata serialization
- Fix lint errors: remove wastedassign, fix import grouping, fix
  integer conversion in getVersion()

Closes #993

Signed-off-by: SurbhiAgarwal1 <agarwalsurbhi1807@gmail.com>

Author: SurbhiAgarwal1

.github/workflows/tests.yml

@@ -206,3 +206,32 @@ jobs:
       - name: Compile benchmarks (do not run)
         run: go test ./... -run=^$ -bench=^$
 
+  # Guard: the tokengen / artifactgen binaries must build without cgo so
+  # they can be distributed in scratch / alpine images and on hosts
+  # without a C toolchain. See #1445.
+  cgo-check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+          cache-dependency-path: "**/*.sum"
+
+      - name: Download dependencies
+        run: go mod download
+
+      - name: Build tokengen without cgo
+        env:
+          CGO_ENABLED: "0"
+        run: go build -o /dev/null ./cmd/tokengen
+
+      - name: Build artifactgen without cgo
+        env:
+          CGO_ENABLED: "0"
+        run: go build -o /dev/null ./cmd/artifactgen
+

MAINTAINERS.md

@@ -8,7 +8,8 @@ Maintainers
 | Angelo De Caro     | [adecaro][adecaro]                   | adecaro     | <adc@zurich.ibm.com>        |
 | Kaoutar Elkhiyaoui | [KElkhiyaoui][KElkhiyaoui]           | KElkhiyaoui | <kao@zurich.ibm.com>        |
 | Arne Rutjes        | [arner][arner]                       | arner       | <arne.rutjesISC@nl.ibm.com> |
-| Alexandros Filios  | [alexandrosfilios][alexandrosfilios] | lio         | <alexandros.filios@ibm.com> |
+| Alexandros Filios  | [alexandrosfilios][alexandrosfilios] | lio         | <alexandros.filios@alumni.ethz.ch> |
+| Akram Bitar        | [AkramBitar][AkramBitar]             | akrambitar  | <akram@il.ibm.com>        |
 
 **Emeritus Maintainers**
 
@@ -25,3 +26,4 @@ Maintainers
 [ale-linux]: https://github.com/ale-linux
 [arner]: https://github.com/arner
 [alexandrosfilios]: https://github.com/alexandrosfilios
+[AkramBitar]: https://github.com/AkramBitar

Makefile

@@ -156,9 +156,14 @@ clean-fabric-peer-images:
 	docker images -a | grep "_peer_" | awk '{print $3}' | xargs docker rmi
 
 .PHONY: tokengen
-# install tokengen tool
+# install tokengen tool (must build without cgo; see #1445)
 tokengen:
-	@go install ./cmd/tokengen
+	@CGO_ENABLED=0 go install ./cmd/tokengen
+
+.PHONY: artifactgen
+# install artifactgen tool (must build without cgo; see #1445)
+artifactgen:
+	@CGO_ENABLED=0 go install ./cmd/artifactgen
 
 .PHONY: traceinspector
 # install traceinspector tool

README.md

@@ -1,8 +1,8 @@
 # Fabric Token SDK
 [![License](https://img.shields.io/badge/license-Apache%202-blue)](LICENSE)
 [![Go Report Card](https://goreportcard.com/badge/github.com/hyperledger-labs/fabric-token-sdk)](https://goreportcard.com/badge/github.com/hyperledger-labs/fabric-token-sdk)
-[![Go](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/tests.yml/badge.svg)](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/go.yml)
-[![CodeQL](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/codeql-analysis.yml)
+[![Tests](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/tests.yml)
+[![CodeQL](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/codeql-analysis.yml/badge.svg?branch=main)](https://github.com/hyperledger-labs/fabric-token-sdk/actions/workflows/codeql-analysis.yml)
 [![Coverage Status](https://coveralls.io/repos/github/hyperledger-labs/fabric-token-sdk/badge.svg?branch=main)](https://coveralls.io/github/hyperledger-labs/fabric-token-sdk?branch=main)
 
 The `Fabric Token SDK` provides a collection of APIs and services that streamline development for token-based distributed applications.
@@ -15,7 +15,7 @@ The project will be subject to rapid changes to complete the open-sourcing proce
 # Useful Links
 
 - [`Documentation`](docs/README.md): The entry point for the Fabric Token SDK documentation.
-- [`Code Wiki`](https://codewiki.google/repo/hyperledger-labs/fabric-token-sdk): AI-powered documentation, architecture overviews, and interactive exploration of the Fabric Token-SDK codebase.
+- [`Code Wiki`](https://codewiki.google/github.com/hyperledger-labs/fabric-token-sdk): AI-powered documentation, architecture overviews, and interactive exploration of the Fabric Token SDK codebase.
 - [`Development`](docs/development/development.md): All about the development guidelines.
 - [`Contributing`](CONTRIBUTING.md): How to contribute to the project.
 - [`Fabric Samples`](https://github.com/hyperledger/fabric-samples/tree/main/token-sdk) Token SDK sample application is the

ci/scripts/contributors.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# fetch_contributors.sh — Run from inside your token-sdk folder
+
+set -euo pipefail
+
+REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)
+
+echo "📦 Contributors for: $REPO"
+echo ""
+echo "| Name (@username) | Company | Location | Email | Twitter | Followers | Public Repos | Commits |"
+echo "|------------------|---------|----------|-------|---------|-----------|--------------|---------|"
+
+# Step 1: Get contributor stats (additions, deletions, commits per week)
+STATS=$(gh api --cache 1h "/repos/$REPO/stats/contributors")
+
+# Step 2: Get paginated contributor list and enrich each with user profile
+# Using process substitution to avoid subshell issues with variable scope
+CONTRIBUTOR_LOGINS=()
+COUNT=0
+
+while read -r LOGIN; do
+  CONTRIBUTOR_LOGINS+=("$LOGIN")
+  ((COUNT++))
+
+  # Fetch full user profile
+  USER=$(gh api "/users/$LOGIN")
+
+  # Fetch per-contributor stats from cached stats payload
+  # Handle case where stats might be empty or not available
+  if [ "$STATS" != "[]" ] && [ "$STATS" != "{}" ]; then
+    CONTRIB_STATS=$(echo "$STATS" | jq --arg login "$LOGIN" '
+      .[] | select(.author.login == $login) | {
+        commits: ([.weeks[].c] | add // 0),
+        additions: ([.weeks[].a] | add // 0),
+        deletions: ([.weeks[].d] | add // 0)
+      }')
+
+    COMMITS=$(echo "$CONTRIB_STATS"   | jq -r '.commits   // 0')
+    ADDITIONS=$(echo "$CONTRIB_STATS" | jq -r '.additions // 0')
+    DELETIONS=$(echo "$CONTRIB_STATS" | jq -r '.deletions // 0')
+  else
+    # Fallback: get contributor data from the contributors list and extract contributions count
+    # We need to get the contributors list again to find this specific user
+    CONTRIB_DATA=$(gh api --paginate \
+      -H "Accept: application/vnd.github+json" \
+      "/repos/$REPO/contributors" \
+      --jq ".[] | select(.login == \"$LOGIN\")")
+
+    COMMITS=$(echo "$CONTRIB_DATA" | jq -r '.contributions // 0')
+    ADDITIONS="N/A"  # These aren't available without stats
+    DELETIONS="N/A"  # These aren't available without stats
+  fi
+
+  # Extract user information
+  NAME=$(echo "$USER" | jq -r '.name // .login')
+  COMPANY=$(echo "$USER" | jq -r '.company // "N/A"')
+  LOCATION=$(echo "$USER" | jq -r '.location // "N/A"')
+  EMAIL=$(echo "$USER" | jq -r '.email // "N/A"')
+  TWITTER=$(echo "$USER" | jq -r '.twitter_username // "N/A"')
+  if [ "$TWITTER" != "N/A" ]; then
+    TWITTER="@$TWITTER"
+  fi
+  FOLLOWERS=$(echo "$USER" | jq -r '.followers')
+  PUBLIC_REPOS=$(echo "$USER" | jq -r '.public_repos')
+
+  # Print main row
+  echo "| $NAME (@$LOGIN) | $COMPANY | $LOCATION | $EMAIL | $TWITTER | $FOLLOWERS | $PUBLIC_REPOS | $COMMITS |"
+
+  # Print social links if available (indented below the row)
+  BLOG=$(echo "$USER" | jq -r '.blog // empty')
+  LINKEDIN_URL=""
+
+  # Check for LinkedIn in blog field
+  if [ -n "$BLOG" ] && [ "$BLOG" != "N/A" ]; then
+    if [[ "$BLOG" == *"linkedin.com"* ]]; then
+      LINKEDIN_URL="$BLOG"
+    fi
+  fi
+
+  # Fetch social accounts to find LinkedIn if not found in blog
+  if [ -z "$LINKEDIN_URL" ]; then
+    SOCIAL_ACCOUNTS=$(gh api "/users/$LOGIN/social_accounts")
+    LINKEDIN_URL=$(echo "$SOCIAL_ACCOUNTS" | jq -r '.[] | select(.provider == "linkedin") | .url // empty')
+  fi
+
+  if [ -n "$LINKEDIN_URL" ]; then
+    echo "| *💼 LinkedIn:* $LINKEDIN_URL | | | | | | | |"
+  fi
+
+  if [ "$TWITTER" != "N/A" ]; then
+    echo "| *🐦 Twitter:* https://twitter.com/${TWITTER#@} | | | | | | | |"
+  fi
+
+  if [ -n "$BLOG" ] && [ "$BLOG" != "N/A" ] && [ -z "$LINKEDIN_URL" ]; then
+    echo "| *🌐 Website:* $BLOG | | | | | | | |"
+  fi
+
+done < <(gh api --paginate \
+  -H "Accept: application/vnd.github+json" \
+  "/repos/$REPO/contributors" \
+  --jq '.[] | select(.login != "dependabot[bot]") | .login')
+
+# Summary section
+echo ""
+echo "📊 SUMMARY"
+echo ""
+echo "**Total Contributors:** $COUNT"
+
+# Identify IBM contributors (using already fetched data to avoid extra API calls)
+IBM_CONTRIBUTORS=()
+for LOGIN in "${CONTRIBUTOR_LOGINS[@]}"; do
+  # We need to fetch user data to check company/email
+  USER_DATA=$(gh api "/users/$LOGIN")
+  COMPANY=$(echo "$USER_DATA" | jq -r '.company // ""')
+  EMAIL=$(echo "$USER_DATA" | jq -r '.email // ""')
+  NAME=$(echo "$USER_DATA" | jq -r '.name // .login')
+
+  # Check if company, email, or name indicates IBM affiliation
+  if [[ "$COMPANY" == *"IBM"* ]] || [[ "$COMPANY" == *"ibm"* ]] || [[ "$EMAIL" == *"ibm.com"* ]] || [[ "$EMAIL" == *"zurich.ibm.com"* ]] || [[ "$NAME" == *"IBM"* ]] || [[ "$NAME" == *"ibm"* ]]; then
+    IBM_CONTRIBUTORS+=("$NAME (@$LOGIN)")
+  fi
+done
+
+IBM_COUNT=${#IBM_CONTRIBUTORS[@]}
+echo "**IBM Contributors:** $IBM_COUNT"
+
+if [ $IBM_COUNT -gt 0 ]; then
+  echo ""
+  echo "**IBM Contributor List:**"
+  for contributor in "${IBM_CONTRIBUTORS[@]}"; do
+    echo "- $contributor"
+  done
+fi
+
+echo ""
+echo "✅ Done"

ci/scripts/extract_signoffs.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# Target the repository path (defaults to the current directory if not provided)
+REPO_PATH="${1:-.}"
+
+# Verify if the target directory is a valid git repository
+if ! git -C "$REPO_PATH" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    echo "Error: '$REPO_PATH' is not a valid git repository."
+    exit 1
+fi
+
+echo "Extracting deduplicated Signed-off-by emails with counts from: $REPO_PATH"
+echo "------------------------------------------------------------"
+
+# Fetch logs, filter sign-offs, extract emails, count duplicates, and sort by count descending
+git -C "$REPO_PATH" log | \
+    grep -i "^[[:space:]]*Signed-off-by:" | \
+    sed -n 's/.*<\([^>]*\)>.*/\1/p' | \
+    sort | \
+    uniq -c | \
+    sort -nr

ci/scripts/generate-repo-stats.sh

@@ -0,0 +1,148 @@
+#!/bin/bash
+
+REPO="hyperledger-labs/fabric-token-sdk"
+API_URL="https://api.github.com/repos/$REPO"
+SEARCH_API_URL="https://api.github.com/search/issues"
+
+# Require jq and gh for JSON parsing and GitHub API
+if ! command -v jq &> /dev/null; then
+    echo "Error: jq is required but not installed. Please install it (e.g., brew install jq or apt install jq)." >&2
+    exit 1
+fi
+
+if ! command -v gh &> /dev/null; then
+    echo "Error: gh (GitHub CLI) is required but not installed. Please install it (e.g., brew install gh)." >&2
+    exit 1
+fi
+
+# Function to format numbers with commas (Cross-platform pure bash)
+format_num() {
+    local num=$1
+    while [[ $num =~ ^([0-9]+)([0-9]{3})(.*)$ ]]; do
+        num="${BASH_REMATCH[1]},${BASH_REMATCH[2]}${BASH_REMATCH[3]}"
+    done
+    echo "$num"
+}
+
+# Helper to call GitHub API using gh (handles authentication automatically)
+call_api() {
+    local endpoint="$1"
+    gh api "$endpoint" --jq '.'
+}
+
+# Helper to fetch total counts using the paginated Link header
+get_paginated_count() {
+    local endpoint="$1"
+
+    # Fetch headers only using gh
+    local header_file=$(mktemp)
+    gh api "$endpoint" -i > "$header_file" 2>/dev/null
+
+    local link_header=$(grep -i '^link:' "$header_file")
+    if [[ -n "$link_header" ]]; then
+        # Extract the exact page number from the 'last' rel link
+        grep -i '^link:' "$header_file" | sed -E 's/.*<([^>]+)>; rel="last".*/\1/' | sed -E 's/.*page=([0-9]+).*/\1/'
+    else
+        # Fallback to counting the JSON array length if there is only 1 page
+        local items=$(call_api "$endpoint" | jq -r 'length // 0')
+        echo "$items"
+    fi
+    rm -f "$header_file"
+}
+
+# Helper to get issues/PRs counts from Search API
+get_search_count() {
+    local query="$1"
+    gh api "$SEARCH_API_URL?q=repo:$REPO+$query" --jq '.total_count // 0'
+}
+
+echo "Fetching repository metrics..." >&2
+REPO_DATA=$(call_api "$API_URL")
+
+# 1. Repository Metrics
+REPO_URL=$(echo "$REPO_DATA" | jq -r '.html_url // ""')
+LANGUAGE=$(echo "$REPO_DATA" | jq -r '.language // "Unknown"')
+LICENSE=$(echo "$REPO_DATA" | jq -r '.license.name // "None"')
+STARS=$(echo "$REPO_DATA" | jq -r '.stargazers_count // 0')
+FORKS=$(echo "$REPO_DATA" | jq -r '.forks_count // 0')
+WATCHERS=$(echo "$REPO_DATA" | jq -r '.subscribers_count // 0')
+DEFAULT_BRANCH=$(echo "$REPO_DATA" | jq -r '.default_branch // "main"')
+
+echo "Fetching contributors count..." >&2
+CONTRIBUTORS=$(get_paginated_count "$API_URL/contributors?per_page=1&anon=true")
+
+# 2. Community Standards Compliance
+echo "Checking community standards..." >&2
+check_file() {
+    local file=$1
+    local status=$(curl -s -o /dev/null -w "%{http_code}" "https://raw.githubusercontent.com/$REPO/$DEFAULT_BRANCH/$file")
+    if [[ "$status" == "200" ]]; then
+        # Output status with a Markdown link to the file on GitHub
+        echo "✅ [Complete](https://github.com/$REPO/blob/$DEFAULT_BRANCH/$file)"
+    else
+        echo "❌ Missing"
+    fi
+}
+
+README_STATUS=$(check_file "README.md")
+CONTRIBUTING_STATUS=$(check_file "CONTRIBUTING.md")
+CODE_OF_CONDUCT_STATUS=$(check_file "CODE_OF_CONDUCT.md")
+LICENSE_STATUS=$(check_file "LICENSE")
+SECURITY_STATUS=$(check_file "SECURITY.md")
+
+# 3. Development Activity
+echo "Fetching development activity metrics..." >&2
+
+# Cross-platform date parsing (macOS/BSD vs GNU Linux)
+if date --version >/dev/null 2>&1; then
+    SINCE_DATE=$(date -d "30 days ago" -u +"%Y-%m-%dT%H:%M:%SZ")
+else
+    SINCE_DATE=$(date -v-30d -u +"%Y-%m-%dT%H:%M:%SZ")
+fi
+
+COMMITS_30D=$(get_paginated_count "$API_URL/commits?since=$SINCE_DATE&per_page=1")
+OPEN_ISSUES=$(get_search_count "type:issue+state:open")
+CLOSED_ISSUES=$(get_search_count "type:issue+state:closed")
+OPEN_PRS=$(get_search_count "type:pr+state:open")
+CLOSED_PRS=$(get_search_count "type:pr+state:closed")
+
+# Get current date for the header
+CURRENT_DATE=$(date +"%B %d, %Y at %H:%M %Z")
+
+# Output Final Markdown
+echo ""
+cat <<EOF
+## Project Statistics
+
+The following metrics demonstrate the project's maturity, active development, and community engagement ($CURRENT_DATE):
+
+### Repository Metrics
+
+| Metric | Value |
+|--------|-------|
+| **Repository** | [github.com/$REPO]($REPO_URL) |
+| **Primary Language** | $LANGUAGE |
+| **License** | $LICENSE |
+| **Stars** | $(format_num "$STARS") |
+| **Forks** | $(format_num "$FORKS") |
+| **Watchers** | $(format_num "$WATCHERS") |
+| **Total Contributors** | $(format_num "$CONTRIBUTORS") |
+
+### Community Standards Compliance
+| Standard | Status |
+|----------|--------|
+| README | $README_STATUS |
+| CONTRIBUTING | $CONTRIBUTING_STATUS |
+| CODE_OF_CONDUCT | $CODE_OF_CONDUCT_STATUS |
+| LICENSE | $LICENSE_STATUS |
+| SECURITY Policy | $SECURITY_STATUS |
+
+### Development Activity
+| Metric | Count |
+|--------|-------|
+| **Commits (Last 30 Days)** | $(format_num "$COMMITS_30D") |
+| **Open Issues** | $(format_num "$OPEN_ISSUES") |
+| **Closed Issues** | $(format_num "$CLOSED_ISSUES") |
+| **Open Pull Requests** | $(format_num "$OPEN_PRS") |
+| **Closed Pull Requests** | $(format_num "$CLOSED_PRS") |
+EOF