Libraries tagged by supply-chain

A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email

Go to Download

Protects against supply chain attacks by filtering recently published packages.

Go to Download

TUF (The Update Framework) client for PHP: fetch and verify signed metadata and targets

Go to Download

Offline Sigstore bundle verifier for PHP (Fulcio, Rekor, identity policy)

Go to Download

Build Sigstore bundles (.sigstore.json) in PHP — the counterpart to verification, emitting DSSE and message-signature bundles

Go to Download

A PSR-18 client for the Rekor v2 transparency log — submit entries and read checkpoints in PHP

Go to Download

Build, sign and verify in-toto attestation Statements (v1 and v0.1) in PHP

Go to Download

Sign and verify DSSE (Dead Simple Signing Envelope) payloads in PHP, with pluggable keys

Go to Download

Composer plugin that verifies GitHub build-provenance attestations for the packages you install

Go to Download

Protects against supply chain attacks by filtering recently published packages.

Go to Download

SLSA Provenance predicates (v1 and v0.2) for PHP

Go to Download

Sign artifacts and attestations with Sigstore from PHP — sign, log to Rekor, timestamp, and assemble a bundle

Go to Download

Heimdall — a Composer plugin that guards the bridge between Packagist and your vendor directory against supply chain attacks.

Go to Download

Pure-PHP SSHSIG signing and verification, compatible with ssh-keygen -Y

Go to Download

Read, write and canonicalize OpenVEX documents in PHP

Go to Download