Packages

17 packages, grouped by type.

Composer plugins 2

Plugins that check dependencies as Composer installs them.

k2gl/composer-attest Composer plugin: verify GitHub build-provenance attestations at install time. composer require k2gl/composer-attest k2gl/composer-license-gate Composer plugin: gate dependency licenses against an allow/deny policy. composer require k2gl/composer-license-gate

Sigstore & signing 4

Verify and produce Sigstore signatures and bundles in pure PHP.

k2gl/rekor-client A PSR-18 client for the Rekor transparency log (v2 / rekor-tiles). composer require k2gl/rekor-client k2gl/sigstore-bundle Build and read Sigstore bundles (.sigstore.json) in PHP. composer require k2gl/sigstore-bundle k2gl/sigstore-sign Produce Sigstore signatures and bundles from PHP — keyful or keyless (Fulcio/OIDC). composer require k2gl/sigstore-sign k2gl/sigstore-verify Verify Sigstore signatures, certificates, and transparency-log inclusion in pure PHP. composer require k2gl/sigstore-verify

Attestation formats 4

The formats underneath — DSSE, in-toto, SLSA, TUF — as typed PHP.

k2gl/dsse Sign and verify DSSE envelopes (Dead Simple Signing Envelope) in PHP. composer require k2gl/dsse k2gl/in-toto-attestation Build and parse in-toto attestation Statements in PHP. composer require k2gl/in-toto-attestation k2gl/slsa-provenance Model SLSA provenance predicates in PHP. composer require k2gl/slsa-provenance k2gl/tuf A pure-PHP client for The Update Framework (TUF). composer require k2gl/tuf

Signatures & notes 2

SSH signatures and signed-note formats used by transparency logs.

k2gl/signed-note Read and write signed notes (Go sumdb / Rekor checkpoint format). composer require k2gl/signed-note k2gl/sshsig Sign and verify with the SSH signature format (SSHSIG) in PHP. composer require k2gl/sshsig

Developer utilities 5

General-purpose PHP libraries.

k2gl/app-env A small, typed helper for reading application environment. composer require k2gl/app-env k2gl/array-reader Read nested array data with types, defaults, and clear errors. composer require k2gl/array-reader k2gl/entity-exist A Symfony validator constraint that asserts an entity exists. composer require k2gl/entity-exist k2gl/enum Ergonomic helpers for PHP native enums — labels, values, and lookups. composer require k2gl/enum k2gl/phpunit-fluent-assertions Fluent, readable assertions for PHPUnit. composer require k2gl/phpunit-fluent-assertions