Download the PHP package k2gl/sigstore-sign without Composer
On this page you can find all versions of the php package k2gl/sigstore-sign. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download k2gl/sigstore-sign
More information about k2gl/sigstore-sign
Files in k2gl/sigstore-sign
Package sigstore-sign
Short Description Sign artifacts and attestations with Sigstore from PHP — sign, log to Rekor, timestamp, and assemble a bundle
License MIT
Homepage https://github.com/k2gl/sigstore-sign
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package sigstore-sign
Sign with Sigstore from PHP
The Sigstore signing flow, end to end, in PHP: sign an artifact or an attestation,
log the entry to a Rekor v2 transparency log, timestamp the signature, and
assemble the .sigstore.json bundle — the emit counterpart to
k2gl/sigstore-verify.
It ties the family together: k2gl/dsse signs,
k2gl/rekor-client logs,
k2gl/sigstore-bundle is emitted. It does both
keyful signing (you bring the key and its certificate or a public-key hint) and
keyless signing (an ephemeral key certified by Fulcio against a CI OIDC identity).
Requirements
- PHP 8.1+
- A PSR-18 HTTP client and PSR-17 factory (for Rekor and the timestamp authority)
k2gl/dsse,k2gl/rekor-client,k2gl/sigstore-bundle
Installation
Usage
Keyless signing (Fulcio + CI OIDC)
In CI, sign without a long-lived key: read the ambient OIDC identity, let Fulcio certify an ephemeral key against it, and sign with that.
FulcioSigningKey generates the ephemeral P-256 key, proves possession of it to Fulcio by
signing the token's sub, and returns a SigningKey bound to the issued certificate — the
same type keyful signing uses, so the rest of the flow is identical.
Where to sign: the signing config
Sigstore publishes the endpoints to sign against as a TUF target, and a client should read
them rather than hard-code URLs — Rekor v2 log URLs rotate, and the default public config
still points at Rekor v1. SigningConfig parses that target and applies the spec's
selection rules (validity window, supported API version, and the ALL / ANY / EXACT
selector, with EXACT drawing from distinct operators):
Selection is against the moment you pass (at:, defaulting to now) and the versions you
support (supportedApiVersions:), so a client that speaks only Rekor v1 asks for it and
gets the v1 log even from a config that lists both.
Why the timestamp authority matters
A Rekor v2 entry has no integrated time, so a bundle needs a trusted RFC 3161 timestamp to
have a verifiable signing time. Pass a TsaClient (Sigstore's public-good TSA is
timestamp.sigstore.dev) when signing against Rekor v2 — without it, the bundle logs and
assembles but will not verify for lack of a time source. A Rekor v1 entry carries its own
integrated time, so signing against a v1 log needs no TSA.
What gets signed
- Artifact — the signature is over the artifact's SHA-256 digest (the message-signature convention). Use an attestation for Ed25519 keys, which the message-signature path does not cover on the verify side.
- Attestation — the payload is wrapped in a DSSE envelope and the signature is over the PAE; the Rekor entry binds the PAE digest, as Rekor v2 records DSSE attestations.
Errors
Everything thrown implements K2gl\SigstoreSign\Exception\SigstoreSignException:
SigningException (the signing flow), TimestampException (the timestamp authority), and
FulcioException (the OIDC credential or the Fulcio certificate step).
Pull requests are always welcome
All versions of sigstore-sign with dependencies
ext-json Version *
psr/http-client Version ^1.0
psr/http-factory Version ^1.0
psr/http-message Version ^1.1|^2.0
k2gl/dsse Version ^1.3
k2gl/sigstore-bundle Version ^1.0
k2gl/rekor-client Version ^1.1