Start here

Twenty focused PHP packages in three product lines — supply-chain security, digital identity credentials, and everyday utilities. Pick the path that matches what you're trying to do.

Verify what you install

Check that your dependencies were really built by their repositories' CI, at composer install time:

composer require --dev k2gl/composer-attest

Guide: verify provenance at install → · Check any package online →

Sign your own releases

If you publish a package, attest its provenance so others can verify it — one line in a release workflow:

- uses: k2gl/composer-attest-action@v1

Guide: attest your package →

Debug a bundle, envelope, or token

Paste the artifact into a browser tool and see it decoded and verified — a Sigstore bundle, a DSSE envelope, or an SD-JWT. The tools run on these packages.

Verify identity credentials

Accepting SD-JWT VC presentations as a relying party — wallet credentials, dc+sd-jwt:

composer require k2gl/sd-jwt-vc

How the identity packages fit → · Inspect an SD-JWT online →

Reach for a single library

Every layer is its own package — verification, signing, DSSE, in-toto, SLSA, TUF, Rekor — and the utilities stand alone: typed array access, enum helpers, fluent PHPUnit assertions.

All packages → · How the supply-chain stack fits →

Reading with an agent?

Every package has a machine-readable twin. Start from llms.txt, or append .md / .json to any package URL for the same content without the HTML.