k2gl blog https://k2gl.com/blog Notes on PHP supply-chain security, Sigstore, and the k2gl packages. Verify your Composer dependencies' provenance https://k2gl.com/blog/verify-composer-provenance https://k2gl.com/blog/verify-composer-provenance Sign and verify PHP package provenance with Sigstore and GitHub build attestations, end to end. Sun, 05 Jul 2026 00:00:00 GMT