Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/transmute-industries/transmute

Transmute
https://github.com/transmute-industries/transmute

cryptography decentralized-identifiers github-actions graph ietf jose jsonld jwe jwk jws jwt neo4j rdf supply-chain transmute verifiable-credentials visulization w3c

Last synced: 3 days ago
JSON representation

Transmute

Host: GitHub
URL: https://github.com/transmute-industries/transmute
Owner: transmute-industries
License: apache-2.0
Created: 2017-11-21T01:18:35.000Z (almost 7 years ago)
Default Branch: main
Last Pushed: 2024-08-27T20:49:53.000Z (3 months ago)
Last Synced: 2024-11-05T17:01:35.202Z (10 days ago)
Topics: cryptography, decentralized-identifiers, github-actions, graph, ietf, jose, jsonld, jwe, jwk, jws, jwt, neo4j, rdf, supply-chain, transmute, verifiable-credentials, visulization, w3c
Language: TypeScript
Homepage: https://transmute.industries
Size: 50.4 MB
Stars: 58
Watchers: 13
Forks: 12
Open Issues: 1
Metadata Files:
- Readme: README.md
- License: LICENSE

Awesome Lists containing this project

README

# Transmute

[![CI](https://github.com/transmute-industries/transmute/actions/workflows/ci.yml/badge.svg)](https://github.com/transmute-industries/transmute/actions/workflows/ci.yml)
[![NPM](https://nodei.co/npm/@transmute/cli.png?mini=true)](https://npmjs.org/package/@transmute/cli)

#### [Questions?](https://transmute.typeform.com/to/RshfIw?typeform-source=cli)

## Usage

### GitHub Action

```yaml
name: CI
on: [push]
jobs:
scitt:
runs-on: ubuntu-latest
steps:
- name: Issue Statement
id: issue_statement
uses: transmute-industries/transmute@main
with:
transmute: |
scitt issue-statement ./tests/fixtures/private.sig.key.cbor \
./tests/fixtures/message.json \
--output ./tests/fixtures/message.hash-envelope.cbor
- name: Verify Statement Hash
id: verify_message
uses: transmute-industries/transmute@main
with:
transmute: |
scitt verify-statement-hash ./tests/fixtures/public.sig.key.cbor \
./tests/fixtures/message.hash-envelope.cbor \
3073d614f853aaec9a1146872c7bab75495ee678c8864ed3562f8787555c1e22
- name: Issue Receipt
id: issue_receipt
uses: transmute-industries/transmute@main
with:
transmute: |
scitt issue-receipt ./tests/fixtures/private.notary.key.cbor \
./tests/fixtures/message.hash-envelope.cbor \
--log ./tests/fixtures/trans.json
- name: Verify Receipt Hash
id: verify_receipt
uses: transmute-industries/transmute@main
with:
transmute: |
scitt verify-receipt-hash ./tests/fixtures/public.notary.key.cbor \
./tests/fixtures/message.hash-envelope-with-receipt.cbor \
3073d614f853aaec9a1146872c7bab75495ee678c8864ed3562f8787555c1e22
```

See [CI](./.github/workflows/ci.yml) for more examples.

### Nodejs CLI

Install as global binary:

```sh
npm i -g @transmute/cli@latest
```

#### Getting Started

```sh

echo '"@context":
- https://www.w3.org/ns/credentials/v2
- https://www.w3.org/ns/credentials/examples/v2
type:
- VerifiableCredential
- MyPrototypeCredential
credentialSubject:
!sd mySubjectProperty: mySubjectValue
' > ./tests/fixtures/issuer-disclosable-claims.yaml

echo '"@context":
- https://www.w3.org/ns/credentials/v2
- https://www.w3.org/ns/credentials/examples/v2
type:
- VerifiableCredential
- MyPrototypeCredential
credentialSubject:
mySubjectProperty: mySubjectValue
' > ./tests/fixtures/holder-disclosed-claims.yaml

transmute jose keygen --alg ES256 \
--output ./tests/fixtures/private.sig.jwk.json

transmute vcwg issue-credential ./tests/fixtures/private.sig.jwk.json \
./tests/fixtures/issuer-disclosable-claims.yaml \
--credential-type application/vc-ld+sd-jwt \
--output ./tests/fixtures/issuer-disclosable-claims.sd-jwt
```

See [scripts](./scripts/) for more examples.

graph after ci runs

TODO: all command examples

## Use Cases

### Software Supply Chain

#### In Search of Transparency

##### Product Integrity

```bash

sbom-tool generate -b ./dist -bc ./ -pn transmute -ps transmute.industries \
-pv `jq -r .version package.json` -nsu `git rev-parse --verify HEAD`

transmute scitt issue-statement ./tests/fixtures/private.notary.key.cbor \
./dist/_manifest/spdx_2.2/manifest.spdx.json \
--iss https://software.vendor.example \
--sub `jq -r .documentNamespace ./dist/_manifest/spdx_2.2/manifest.spdx.json` \
--content-type application/spdx+json \
--location https://github.com/.../dist/_manifest/spdx_2.2/manifest.spdx.json \
--output ./dist/_manifest/spdx_2.2/manifest.spdx.scitt.cbor

transmute scitt issue-receipt ./tests/fixtures/private.notary.key.cbor \
./dist/_manifest/spdx_2.2/manifest.spdx.scitt.cbor \
--iss https://software.notary.example \
--sub `jq -r .documentNamespace ./dist/_manifest/spdx_2.2/manifest.spdx.json` \
--log ./tests/fixtures/trans.json \
--output ./dist/_manifest/spdx_2.2/manifest.spdx.scitt.cbor

transmute scitt verify-receipt-hash ./tests/fixtures/public.notary.key.cbor \
./dist/_manifest/spdx_2.2/manifest.spdx.scitt.cbor \
`cat ./dist/_manifest/spdx_2.2/manifest.spdx.json.sha256`

```

command line image of build script execution

##### Compliance Automation

```yaml
name: CI
on: [push]
jobs:
scitt:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Push Transparency
uses: transmute-industries/transmute@main
with:
neo4j-uri: ${{ secrets.NEO4J_URI }}
neo4j-user: ${{ secrets.NEO4J_USERNAME }}
neo4j-password: ${{ secrets.NEO4J_PASSWORD }}
transmute: |
graph assist ./dist/_manifest/spdx_2.2/manifest.spdx.scitt.cbor \
--credential-type application/cose \
--graph-type application/gql \
--push
```

graph query results