Download the PHP package k2gl/signed-note without Composer
On this page you can find all versions of the php package k2gl/signed-note. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download k2gl/signed-note
More information about k2gl/signed-note
Files in k2gl/signed-note
Package signed-note
Short Description Parse, verify and sign signed notes — the transparency-log / Go sumdb format used by Sigstore Rekor checkpoints — in PHP
License MIT
Homepage https://github.com/k2gl/signed-note
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package signed-note
k2gl/signed-note
Parse, verify and sign signed notes in PHP — the format Go's sumdb and transparency-log checkpoints (Sigstore Rekor) use. A note is some text, a blank line, then one or more signature lines:
Each signature line is — <name> <base64>, where the base64 decodes to a 4-byte
key hash and the raw signature over the text. The cryptography is delegated to
[k2gl/dsse].
Install
Requires PHP 8.1+ with ext-sodium (Ed25519); ext-openssl is needed only for
ECDSA-signed notes such as Rekor v1 checkpoints.
Verify
Give a NoteVerifier the keys you trust; it returns the signatures that verify
and throws if none do.
A Rekor checkpoint is a note signed by the log's key. Load that key from its PEM — the key hash is derived the Sigstore way (first four bytes of SHA-256 of the DER key), and any RSA/ECDSA/Ed25519 key works:
Checkpoints
A transparency log publishes its head as a checkpoint: a note whose text is the
log's origin, the tree size and the base64 root hash, one per line (further lines
are extensions). Checkpoint reads those three lines; the signatures stay the
note's, so it is verified with the log's key like any other note.
A Rekor v2 log signs with an Ed25519 key whose hash is the note one (origin plus
key), hence VerifierKey::ed25519(); a Rekor v1 log's ECDSA key is fromPem() as
above. The test suite reads a real log2025-1.rekor.sigstore.dev checkpoint and
verifies it against the key from Sigstore's trusted root.
Sign
The output is byte-for-byte what Go's note.Sign produces (checked against the
golang.org/x/mod/sumdb/note test vectors).
Design
- Two layers.
Noteis the generic note and knows nothing about logs;Checkpointadds the meaning of the first three lines and nothing else. - Fail-closed. A verified result means a trusted key signed the exact text.
- Ed25519 is the standard.
VerifierKey::fromString()/SignerKeyhandle the Ed25519 key strings from Go'snotepackage;fromPem()covers ECDSA/RSA logs.
License
MIT.
