Guides

• Verify build provenance at composer install

  Add the composer-attest plugin so Composer checks each dependency's GitHub build-provenance attestation as it downloads it.

• Attest your own Composer package

  Add build-provenance attestations to your package's releases with one line, using composer-attest-action — so anyone can verify what they install.

• Sign and verify a blob end to end

  Produce a Sigstore bundle for an artifact with sigstore-sign, then verify it with sigstore-verify — keyless, in pure PHP.

• Keyless signing in GitHub Actions

  Exchange the workflow's OIDC token for a Fulcio certificate and produce a Sigstore bundle from PHP — no long-lived keys anywhere.

• Gate dependency licenses at install

  Fail composer install when a dependency's license falls outside your policy, using the composer-license-gate plugin.

• Verify an SD-JWT VC presentation

  Accept a dc+sd-jwt credential as a relying party: check the issuer signature, the disclosures, and the holder's key binding — in PHP.

• From in-toto statement to signed SLSA provenance

  Build a SLSA v1 provenance predicate, wrap it in an in-toto statement, and sign it — first as a bare DSSE envelope, then as a full Sigstore bundle.

• VEX in PHP: suppress a CVE with an audit trail

  Author an OpenVEX document in PHP, get its canonical id, query it, and optionally attest it as a signed in-toto statement — one package for the format, existing ones for the signature.

• Typed access to messy arrays

  Replace isset() ladders over query strings, config and decoded JSON with typed reads, defaults, and errors that say what's actually missing.