PHP code example of k2gl / slsa-provenance

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

k2gl / slsa-provenance example snippets

use K2gl\Slsa\Provenance;
use K2gl\Slsa\BuildDefinition;
use K2gl\Slsa\RunDetails;
use K2gl\Slsa\Builder;
use K2gl\Slsa\BuildMetadata;
use K2gl\InToto\ResourceDescriptor;

$provenance = new Provenance(
    new BuildDefinition(
        buildType: 'https://example.com/buildtypes/v1',
        externalParameters: ['repository' => 'https://github.com/k2gl/dsse', 'ref' => 'refs/tags/1.0.0'],
        resolvedDependencies: [
            new ResourceDescriptor(uri: 'git+https://github.com/k2gl/dsse', digest: ['gitCommit' => '…']),
        ],
    ),
    new RunDetails(
        builder: new Builder(id: 'https://github.com/actions/runner', version: ['runner' => '2.x']),
        metadata: new BuildMetadata(invocationId: 'run-42', startedOn: '2026-05-30T00:00:00Z'),
    ),
);

// Wrap as an in-toto Statement over the built artifacts, then sign with k2gl/dsse:
$statement = $provenance->toStatement([
    new ResourceDescriptor(name: 'app.phar', digest: ['sha256' => '…']),
]);
$envelope = $statement->sign($signer);   // K2gl\Dsse\Envelope

use K2gl\InToto\Statement;
use K2gl\Slsa\Provenance;

$statement  = Statement::fromEnvelope($envelope);
$provenance = Provenance::fromStatement($statement);   // checks predicateType

$provenance->buildDefinition->buildType;          // 'https://example.com/buildtypes/v1'
$provenance->runDetails->builder->id;             // 'https://github.com/actions/runner'
$provenance->runDetails->metadata?->invocationId; // 'run-42'

use K2gl\InToto\Statement;
use K2gl\Slsa\V02\Provenance;

$statement  = Statement::fromEnvelope($envelope);   // verify signatures first
$provenance = Provenance::fromStatement($statement);

$provenance->builder->id;                              // 'https://github.com/…'
$provenance->buildType;                                // 'https://…/generic@v1'
$provenance->invocation?->configSource?->uri;          // 'git+https://github.com/…'
$provenance->metadata?->completeness?->parameters;     // true
$provenance->materials[0]->digest;                     // ['sha1' => '…']

use K2gl\InToto\StatementVersion;
use K2gl\Slsa\V02\Builder;
use K2gl\Slsa\V02\Provenance;

$provenance = new Provenance(
    builder: new Builder(id: 'https://github.com/actions/runner'),
    buildType: 'https://github.com/slsa-framework/slsa-github-generator/generic@v1',
);

$statement = $provenance->toStatement([$subject]);                       // in-toto Statement v0.1
$statement = $provenance->toStatement([$subject], StatementVersion::V1); // …or v1

use K2gl\InToto\ResourceDescriptor;
use K2gl\Slsa\VerificationResult;
use K2gl\Slsa\VerificationSummary;
use K2gl\Slsa\Verifier;

$vsa = new VerificationSummary(
    verifier: new Verifier(id: 'https://github.com/slsa-framework/slsa-verifier', version: ['slsa-verifier' => 'v2.4.1']),
    timeVerified: '2026-07-11T12:00:00Z',
    resourceUri: 'pkg:composer/k2gl/[email protected]',
    policy: new ResourceDescriptor(uri: 'https://example.com/policy.yaml', digest: ['sha256' => '…']),
    verificationResult: VerificationResult::Passed,
    verifiedLevels: ['SLSA_BUILD_LEVEL_3'],
    slsaVersion: '1.0',                              // optional
    dependencyLevels: ['SLSA_BUILD_LEVEL_3' => 5],   // optional
);

$statement = $vsa->toStatement([
    new ResourceDescriptor(name: 'dsse.zip', digest: ['sha256' => '…']),
]);
$envelope = $statement->sign($signer);

use K2gl\InToto\Statement;
use K2gl\Slsa\VerificationResult;
use K2gl\Slsa\VerificationSummary;

$statement = Statement::fromEnvelope($envelope);
$vsa       = VerificationSummary::fromStatement($statement);   // checks predicateType

$vsa->verificationResult === VerificationResult::Passed;  // true
$vsa->verifiedLevels;                                     // ['SLSA_BUILD_LEVEL_3']
$vsa->policy->digestFor('sha256');                        // '…'

use K2gl\InToto\Statement;
use K2gl\Slsa\Predicates;
use K2gl\Slsa\Provenance;

Predicates::register();                  // registers v1, v0.2 and VSA in the shared registry

$statement = Statement::fromEnvelope($envelope);
$predicate = $statement->predicate();    // a K2gl\Slsa\Provenance (or V02\Provenance), else the raw array

if ($predicate instanceof Provenance) {
    echo $predicate->buildDefinition->buildType;
}