k2gl

Comparisons

A TUF client for PHP?

Yes. k2gl/tuf is a pure-PHP client for The Update Framework (TUF) — it resolves and verifies the metadata chain (root, targets, snapshot, timestamp) so you can trust what a repository claims to distribute.

Common use

If you’re verifying Sigstore signatures, you may not need TUF directly — k2gl/sigstore-verify uses it under the hood to fetch Sigstore’s trusted root. Reach for k2gl/tuf on its own when you:

  • consume a TUF-secured repository and need to verify its metadata, or
  • build a client that distributes signed artifacts with TUF’s freshness and key-rotation guarantees.

Install

composer require k2gl/tuf

See the supply-chain overview.