Download the PHP package k2gl/sshsig without Composer

On this page you can find all versions of the php package k2gl/sshsig. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of k2gl/sshsig

Informations about the package sshsig

k2gl/sshsig

CI Latest Stable Version Total Downloads PHPStan License

Sign and verify files with SSH keys in PHP, in the OpenSSH SSHSIG format that ssh-keygen -Y sign/verify produces (the signatures Git uses for commit and tag signing). Verifying checks the signer against an allowed_signers file; signing emits bytes ssh-keygen -Y verify accepts. No dependencies.

Fail-closed by design: anything malformed, unsupported, cryptographically invalid, or unauthorized throws — nothing is ever silently treated as verified.

Install

Requires PHP 8.1+ with ext-sodium (Ed25519) and ext-openssl (RSA and ECDSA) — both are bundled with most PHP builds.

Usage

Verify a signature against an allowed_signers file

This is the equivalent of ssh-keygen -Y verify -f allowed_signers -I <identity> -n <namespace>.

Check a signature without authorizing the signer

The equivalent of ssh-keygen -Y check-novalidate -n <namespace>: confirm the signature is structurally sound and cryptographically valid under its own embedded key, then inspect it.

Sign a message

Produce an SSHSIG signature (the ssh-keygen -Y sign operation). Provide the signing key — Ed25519 (a 64-byte libsodium secret key) or an OpenSSL RSA/ECDSA private key:

$signer->publicKey() returns the matching SshPublicKey (e.g. to build an allowed_signers line). The default hash is sha512; pass hashAlgorithm: 'sha256' to switch.

Inspect or build allowed_signers in memory

Design

License

MIT. See LICENSE.

All versions of sshsig with dependencies

PHP Build Version
Package Version
Requires php Version >=8.1
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package k2gl/sshsig contains the following files

Loading the files please wait ...