k2gl

Comparisons

SLSA provenance in PHP?

Yes. k2gl/slsa-provenance models SLSA provenance predicates (v1 and v0.2) as typed PHP — the builder, the build definition, materials and byproducts — instead of hand-built arrays.

Where it fits

A SLSA predicate is only half of an attestation. The full flow in PHP:

  1. Build the predicate — k2gl/slsa-provenance.
  2. Wrap it in a Statement — k2gl/in-toto-attestation (subject + predicateType + predicate).
  3. Sign it — k2gl/dsse envelope, or a full Sigstore bundle via k2gl/sigstore-sign.
  4. Verify it — k2gl/sigstore-verify.

Install

composer require k2gl/slsa-provenance

See the supply-chain overview for how the pieces compose.