Libraries tagged by attestation

A PHP library to aid in verifying artifact attestations

Go to Download

Build, sign and verify in-toto attestation Statements (v1 and v0.1) in PHP

Go to Download

SLSA Provenance predicates (v1 and v0.2) for PHP

Go to Download

Offline Sigstore bundle verifier for PHP (Fulcio, Rekor, identity policy)

Go to Download

Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP, with pluggable keys

Go to Download

Composer plugin that verifies GitHub build-provenance attestations for the packages you install

Go to Download

Vortos Release — immutable build manifests, schema fingerprinting, rollback invariant math, semver/changelog, and coordinated multi-repo tagging. Write-once persistence enforced at the storage layer; provenance-ready for cosign/SLSA attestation.

Go to Download

Testimonials for Contao

Go to Download

Sign artifacts and attestations with Sigstore from PHP — sign, log to Rekor, timestamp, and assemble a bundle

Go to Download

Build Sigstore bundles (.sigstore.json) in PHP — the counterpart to verification, emitting DSSE and message-signature bundles

Go to Download

Attest that an ML-KEM-768 key exchange really happened, with key confirmation, and record it with an expiry. It does not protect a channel.

Go to Download

FIDO MDS trust-anchor lookups for WebAuthn: metadata blob download, JWT verification, trust-anchor cache and attestation chain trust decisions

Go to Download

Fork of web-auth/webauthn-lib that supports Android FIDO2/Passkey attestations

Go to Download

WebAuthn / FIDO2 passkey authentication: registration and assertion ceremonies, attestation verification, challenge handling

Go to Download

Use this code to validate attestation and assertions from appdb app attestation API

Go to Download