k2gl

Open-source PHP libraries.

21 focused packages in three lines: supply-chain security — verify and produce build provenance, Sigstore in pure PHP; digital identity — SD-JWT credentials the EUDI way; and small developer utilities for everyday work. Typed, tested, MIT.

Browse the packages → Try the online tools →

Supply-chain security 13

Verify and produce provenance: Sigstore in pure PHP, the attestation formats underneath, and Composer plugins that check dependencies at install.

k2gl/sigstore-verify · k2gl/composer-attest · k2gl/dsse · all →

Digital identity & credentials 3

SD-JWT and SD-JWT VC (RFC 9901) — the selective-disclosure credential formats behind OpenID4VC and the EU Digital Identity Wallet — plus Token Status List for revocation.

k2gl/sd-jwt · k2gl/sd-jwt-vc · k2gl/token-status-list · all →

Developer utilities 5

Small, focused PHP libraries for everyday work.

k2gl/array-reader · k2gl/enum · all →

Try it in your browser

Online tools that run on these packages — the tool output is the package output.

Sigstore bundle inspector Decode a .sigstore.json bundle — certificate, Fulcio extensions, transparency log — and verify it for real. DSSE envelope debugger Decode a DSSE envelope, preview its PAE, and check a signature against your public key. SD-JWT debugger Decode an SD-JWT or SD-JWT VC: disclosures, recomputed digests, recreated claims, signature. Composer attestation checker Does a Packagist package publish verifiable build provenance? Check any vendor/package. SSH signature verifier Verify an SSHSIG signature the ssh-keygen -Y way — with or without an allowed_signers list. SD-JWT generator Issue a demo SD-JWT with the claims you choose disclosable, signed by a throwaway key. Provenance viewer Render an in-toto statement or SLSA provenance — subjects, builder, dependencies — from JSON or a DSSE envelope. PEM ⇄ JWK converter Convert keys between PEM and JWK entirely in your browser — nothing is uploaded.

New here? Start routes you by task — verify your dependencies, sign a release, debug a token, or grab a single library.

From the blog: PHP signs with Sigstore now · all guides →

Reading with an agent? Every package has a markdown twin and a /llms.txt index — usable without reading the source.