Libraries tagged by supply-chain

A deterministic Laravel security gate for CI and deployment pipelines

Go to Download

Protects against supply chain attacks by filtering recently published packages.

Go to Download

Protects against supply chain attacks by filtering recently published packages.

Go to Download

Heimdall — a Composer plugin that guards the bridge between Packagist and your vendor directory against supply chain attacks.

Go to Download

A dependency audit trust file for PHP.

Go to Download

TUF (The Update Framework) client for PHP: fetch and verify signed metadata and targets

Go to Download

SLSA Provenance predicates (v1 and v0.2) for PHP

Go to Download

Offline Sigstore bundle verifier for PHP (Fulcio, Rekor, identity policy)

Go to Download

Build Sigstore bundles (.sigstore.json) in PHP — the counterpart to verification, emitting DSSE and message-signature bundles

Go to Download

A PSR-18 client for the Rekor transparency log (v1 and v2) — submit hashedrekord entries from PHP

Go to Download

Build, sign and verify in-toto attestation Statements (v1 and v0.1) in PHP

Go to Download

Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP, with pluggable keys

Go to Download

Composer plugin that verifies GitHub build-provenance attestations for the packages you install

Go to Download

A dependency audit trust file for PHP.

Go to Download

Sign artifacts and attestations with Sigstore from PHP — sign, log to Rekor, timestamp, and assemble a bundle

Go to Download