{"id":51514895,"url":"https://github.com/k2gl/sigstore-php-demo","last_synced_at":"2026-07-08T10:30:32.815Z","repository":{"id":364923474,"uuid":"1265679581","full_name":"k2gl/sigstore-php-demo","owner":"k2gl","description":"Verify Sigstore attestations of real signed releases in pure PHP — runnable article companion","archived":false,"fork":false,"pushed_at":"2026-06-15T04:22:11.000Z","size":25,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-06-15T06:22:01.621Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/k2gl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-11T01:52:02.000Z","updated_at":"2026-06-15T04:22:14.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/k2gl/sigstore-php-demo","commit_stats":null,"previous_names":["k2gl/sigstore-php-demo"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/k2gl/sigstore-php-demo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k2gl%2Fsigstore-php-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k2gl%2Fsigstore-php-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k2gl%2Fsigstore-php-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k2gl%2Fsigstore-php-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/k2gl","download_url":"https://codeload.github.com/k2gl/sigstore-php-demo/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/k2gl%2Fsigstore-php-demo/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35262336,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-08T02:00:06.796Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-08T10:30:31.082Z","updated_at":"2026-07-08T10:30:32.801Z","avatar_url":"https://github.com/k2gl.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# sigstore-php-demo\n\nRunnable demo: verify [Sigstore](https://www.sigstore.dev/) attestations of real signed\nreleases in pure PHP, offline, in about five minutes. Companion repository for the\n[k2gl/sigstore-verify](https://github.com/k2gl/sigstore-verify) article series.\n\nThe `examples/` directory contains a real release artifact of\n[k2gl/dsse](https://github.com/k2gl/dsse) together with its attestation bundle, exactly\nas published by GitHub Artifact Attestations: a tarball built by a GitHub Actions\nworkflow and signed keyless through the Sigstore public-good instance (Fulcio\ncertificate, DSSE envelope with SLSA provenance, Rekor transparency-log proof).\n\n## Quick start\n\n```bash\ngit clone https://github.com/k2gl/sigstore-php-demo.git\ncd sigstore-php-demo\ncomposer install\n```\n\nVerify the example artifact with the CLI — fully offline, against the bundled\ntrusted-root snapshot:\n\n```bash\nvendor/bin/sigstore-verify examples/dsse-1.1.1.tar.gz examples/dsse-1.1.1.tar.gz.sigstore.jsonl \\\n  --repository k2gl/dsse --workflow attest.yml --ref refs/tags/1.1.1 \\\n  --trusted-root trusted_root.json\n```\n\nOr from PHP code, with typed SLSA provenance on top:\n\n```bash\nphp verify.php examples/dsse-1.1.1.tar.gz examples/dsse-1.1.1.tar.gz.sigstore.jsonl \\\n  k2gl/dsse refs/tags/1.1.1 trusted_root.json\n```\n\nExpected output:\n\n```\nVERIFIED\nsubject:   dsse-1.1.1.tar.gz (sha256:7a719ac27ce8c64af4992222213dcbfc240d412719e0b5e6107392f4e6c9f7ba)\nbuilder:   https://github.com/k2gl/dsse/.github/workflows/attest.yml@refs/tags/1.1.1\ncommit:    d9716be40f51e2bc32f6328a4f1830dd12156a45\n```\n\n## Watch it fail closed\n\n`negative.php` runs two attacks against the same bundle — a tampered artifact and a\nforged signer identity — and expects both to be rejected:\n\n```bash\nphp negative.php examples/dsse-1.1.1.tar.gz examples/dsse-1.1.1.tar.gz.sigstore.jsonl \\\n  k2gl/dsse refs/tags/1.1.1 trusted_root.json\n```\n\n## Verify any other release\n\nAny public repository that uses\n[GitHub Artifact Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations)\nworks the same way. Download an artifact and its bundle, then point the verifier at them:\n\n```bash\ngh release download \u003ctag\u003e --repo \u003cowner\u003e/\u003crepo\u003e --pattern '\u003cartifact\u003e'\ngh attestation download \u003cartifact\u003e --repo \u003cowner\u003e/\u003crepo\u003e\n\nvendor/bin/sigstore-verify \u003cartifact\u003e sha256:*.jsonl --repository \u003cowner\u003e/\u003crepo\u003e\n```\n\n## Files\n\n| File | Purpose |\n|---|---|\n| `verify.php` | library-level verification + typed SLSA provenance |\n| `negative.php` | fail-closed demo: tampered artifact, wrong identity |\n| `trusted_root.json` | snapshot of the Sigstore public-good trusted root for offline runs |\n| `examples/` | a real signed release: tarball + attestation bundle |\n\n## About the trusted root\n\n`trusted_root.json` is a snapshot: good enough for the demo, but a stale or substituted\ntrust root silently undermines verification. For real deployments either refresh it\nperiodically (it is distributed via TUF) or omit the `--trusted-root` option and let the\nverifier fetch the current root through its built-in TUF client (one network call).\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fk2gl%2Fsigstore-php-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fk2gl%2Fsigstore-php-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fk2gl%2Fsigstore-php-demo/lists"}