k2gl/sigstore-verify
Offline, fail-closed PHP verifier for Sigstore bundles: Fulcio certificate chain, DSSE or message signature, Rekor v1/v2 transparency-log proof, RFC 3161 timestamp, certificate transparency and identity policy. Passes the official sigstore-conformance suite.
- Latest release
- 3d ago
- Releases
- 12
- Known CVEs
- 0
- First release
- May 30, 2026
- License
- MIT
Repository
Source
- Stars
- —
- Forks
- —
- Open issues
- —
Security score
No OpenSSF Scorecard available for this repository.
Packages from this repo
No other tracked packages from this repository.
Insights
Activity
- Total releases
- 12
- Last 12 months
- 12
- Cadence
- ~daily
- Dependencies
- 3
Releases per month
last 12 monthsRelease mix
- major 1
- minor 9
- patch 1
12
releases
Dependencies
Depends on
1.3.0-
k2gl/in-toto-attestation
^1.0
-
k2gl/tuf
^1.0
-
phpseclib/phpseclib
^3.0
Used by
1Releases
| Version | Released | |
|---|---|---|
1.3.0
minor
| ||
1.2.0
minor
| ||
1.1.0
minor
| ||
1.0.0
major
| ||
0.7.0
minor
| ||
0.6.0
minor
| ||
0.5.0
minor
| ||
0.4.0
minor
| ||
0.3.0
minor
| ||
0.2.0
minor
| ||
0.1.1
patch
| ||
0.1.0
initial
|