Packages

20 packages in three product lines.

Supply-chain security

Verify and produce provenance: Sigstore in pure PHP, the attestation formats underneath, and Composer plugins that check dependencies at install. Overview →

Composer plugins 2

Plugins that check dependencies as Composer installs them.

k2gl/composer-attest Composer plugin: verify GitHub build-provenance attestations at install time. composer require k2gl/composer-attest k2gl/composer-license-gate Composer plugin: gate dependency licenses against an allow/deny policy. composer require k2gl/composer-license-gate

Sigstore & signing 4

Verify and produce Sigstore signatures and bundles in pure PHP.

k2gl/sigstore-verify Verify Sigstore signatures, certificates, and transparency-log inclusion in pure PHP. composer require k2gl/sigstore-verify k2gl/sigstore-sign Produce Sigstore signatures and bundles from PHP — keyful or keyless (Fulcio/OIDC). composer require k2gl/sigstore-sign k2gl/sigstore-bundle Build and read Sigstore bundles (.sigstore.json) in PHP. composer require k2gl/sigstore-bundle k2gl/rekor-client A PSR-18 client for the Rekor transparency log (v2 / rekor-tiles). composer require k2gl/rekor-client

Attestation formats 5

The formats underneath — DSSE, in-toto, SLSA, TUF — as typed PHP.

k2gl/dsse Sign and verify DSSE envelopes (Dead Simple Signing Envelope) in PHP. composer require k2gl/dsse k2gl/in-toto-attestation Build and parse in-toto attestation Statements in PHP. composer require k2gl/in-toto-attestation k2gl/slsa-provenance Model SLSA provenance predicates in PHP. composer require k2gl/slsa-provenance k2gl/tuf A pure-PHP client for The Update Framework (TUF). composer require k2gl/tuf k2gl/openvex Read, write and canonicalize OpenVEX documents in PHP. composer require k2gl/openvex

Signatures & notes 2

SSH signatures and signed-note formats used by transparency logs.

k2gl/sshsig Sign and verify with the SSH signature format (SSHSIG) in PHP. composer require k2gl/sshsig k2gl/signed-note Read and write signed notes (Go sumdb / Rekor checkpoint format). composer require k2gl/signed-note

Digital identity & credentials

SD-JWT and SD-JWT VC (RFC 9901) — the selective-disclosure credential formats behind OpenID4VC and the EU Digital Identity Wallet. Overview →

k2gl/sd-jwt Selective Disclosure for JWTs (RFC 9901): issue, present, verify. composer require k2gl/sd-jwt k2gl/sd-jwt-vc SD-JWT Verifiable Credentials (dc+sd-jwt): issue and verify. composer require k2gl/sd-jwt-vc

Developer utilities

Small, focused PHP libraries for everyday work.

k2gl/array-reader Read nested array data with types, defaults, and clear errors. composer require k2gl/array-reader k2gl/enum Ergonomic helpers for PHP native enums — labels, values, and lookups. composer require k2gl/enum k2gl/entity-exist A Symfony validator constraint that asserts an entity exists. composer require k2gl/entity-exist k2gl/phpunit-fluent-assertions Fluent, readable assertions for PHPUnit. composer require k2gl/phpunit-fluent-assertions k2gl/app-env A small, typed helper for reading application environment. composer require k2gl/app-env