PHPackages                             k2gl/rekor-client - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. k2gl/rekor-client

ActiveLibrary[HTTP & Networking](/categories/http)

k2gl/rekor-client
=================

A PSR-18 client for the Rekor v2 transparency log — submit entries and read checkpoints in PHP

1.0.1(1mo ago)0406↑620%1MITPHPPHP >=8.1CI passing

Since Jul 4Pushed 1mo agoCompare

[ Source](https://github.com/k2gl/rekor-client)[ Packagist](https://packagist.org/packages/k2gl/rekor-client)[ Docs](https://github.com/k2gl/rekor-client)[ RSS](/packages/k2gl-rekor-client/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (9)Versions (3)Used By (1)

Rekor v2 client for PHP
=======================

[](#rekor-v2-client-for-php)

[![CI](https://camo.githubusercontent.com/6d3ef3aa6ce5859bba5972bcc26d7ed83f922ce4336825fac1db2fa17a479985/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6b32676c2f72656b6f722d636c69656e742f63692e796d6c3f6272616e63683d6d61696e266c6162656c3d4349266c6f676f3d676974687562)](https://github.com/k2gl/rekor-client/actions/workflows/ci.yml)[![Latest Stable Version](https://camo.githubusercontent.com/5ee7a0803818dcf204080b3d7ea2116f6db45644212e021b42ea4a118a4f332c/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6b32676c2f72656b6f722d636c69656e743f6c6f676f3d7061636b6167697374266c6f676f436f6c6f723d7768697465)](https://packagist.org/packages/k2gl/rekor-client)[![PHPStan Level](https://camo.githubusercontent.com/01c58e66f2fafb70c17613ff2b1da3f549aade3a735b076da5cd9e5c04b945a5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230392d3261356561373f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://phpstan.org)[![License](https://camo.githubusercontent.com/d410cce4b0380b6f4be550840bfd03f716f9e358fefc35564ceb3d251b25e71f/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6b32676c2f72656b6f722d636c69656e743f636f6c6f723d79656c6c6f77677265656e)](https://packagist.org/packages/k2gl/rekor-client)

Submit entries to a [Rekor v2](https://github.com/sigstore/rekor-tiles) (rekor-tiles) transparency log from PHP and get back the transparency-log entry Rekor integrated — the same value [`k2gl/sigstore-bundle`](https://github.com/k2gl/sigstore-bundle) takes, so a signer goes **submit → add to bundle** with no glue in between.

Transport is any [PSR-18](https://www.php-fig.org/psr/psr-18/) HTTP client you supply (Guzzle, Symfony HttpClient, …). This package speaks the Rekor API; it owns no socket.

Requirements
------------

[](#requirements)

- PHP 8.1+
- A PSR-18 HTTP client and a PSR-17 factory (e.g. `nyholm/psr7` + `symfony/http-client`)
- [`k2gl/sigstore-bundle`](https://github.com/k2gl/sigstore-bundle)

Installation
------------

[](#installation)

```
composer require k2gl/rekor-client
```

Usage
-----

[](#usage)

```
use K2gl\RekorClient\RekorClient;
use K2gl\RekorClient\Verifier;
use K2gl\RekorClient\KeyDetails;

$rekor = new RekorClient(
    httpClient:     $psr18Client,
    requestFactory: $psr17Factory,
    streamFactory:  $psr17Factory,
    baseUrl:        'https://rekor.sigstore.dev', // the v2 log URL from your signing config
);

// A hashedrekord entry: the artifact digest, the signature, and the key or
// certificate that signed it.
$entry = $rekor->submitHashedRekord(
    digest:    $artifactSha256,        // raw 32-byte digest
    signature: $rawSignature,
    verifier:  Verifier::certificate($fulcioLeafDer, KeyDetails::PKIX_ECDSA_P256_SHA_256),
);

// $entry is a K2gl\SigstoreBundle\TransparencyLogEntry — drop it straight in:
$json = BundleBuilder::forMessageSignature($messageSignature)
    ->withCertificate($fulcioLeafDer)
    ->addTransparencyLogEntry($entry)
    ->toJson();
```

### DSSE attestations

[](#dsse-attestations)

Rekor v2 has no DSSE entry type. Submit the DSSE **PAE** digest and the envelope signature as a hashedrekord — the entry Rekor returns is the one a DSSE bundle carries.

### Signing identity

[](#signing-identity)

- `Verifier::publicKey($der, $keyDetails)` — a bare public key.
- `Verifier::certificate($der, $keyDetails)` — a Fulcio (keyless) certificate.

`KeyDetails` names the algorithm (`PKIX_ECDSA_P256_SHA_256`, `PKIX_ED25519`, …).

Errors
------

[](#errors)

Everything thrown implements `K2gl\RekorClient\Exception\RekorClientException`: `RekorRequestException` (transport failed / request could not be built), `RekorResponseException` (Rekor answered with an error status or an unparseable body, with the HTTP `statusCode`), and `InvalidArgumentException` (bad input).

Scope
-----

[](#scope)

This release covers **submission** (the write path a signer needs) against Rekor v2. Reading back entries and tiles (the C2SP tlog-tiles read API) is not implemented yet; verifying an entry already in a bundle is what [`k2gl/sigstore-verify`](https://github.com/k2gl/sigstore-verify) does.

Pull requests are always welcome
--------------------------------

[](#pull-requests-are-always-welcome)

[Collaborate with pull requests](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request)

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance90

Actively maintained with recent releases

Popularity14

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

48d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/6bc4aa529c7f13ea593297497f6eae20d5c07f476baa0a551960d7e6ff1e5413?d=identicon)[k2gl](/maintainers/k2gl)

---

Top Contributors

[![k2gl](https://avatars.githubusercontent.com/u/2846079?v=4)](https://github.com/k2gl "k2gl (9 commits)")

---

Tags

psr-18checkpointsupply-chainsigstorerekortransparency-logtloghashedrekord

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

Type Coverage Yes

### Embed Badge

![Health badge](/badges/k2gl-rekor-client/health.svg)

```
[![Health](https://phpackages.com/badges/k2gl-rekor-client/health.svg)](https://phpackages.com/packages/k2gl-rekor-client)
```

###  Alternatives

[tempest/framework

The PHP framework that gets out of your way.

2.3k37.6k21](/packages/tempest-framework)[guzzlehttp/psr7

PSR-7 message implementation that also provides common utility methods

7.9k1.1B4.4k](/packages/guzzlehttp-psr7)[flow-php/flow

PHP ETL - Extract Transform Load - Data processing framework

86337.5k](/packages/flow-php-flow)[cakephp/cakephp

The CakePHP framework

8.9k20.0M1.9k](/packages/cakephp-cakephp)[telnyx/telnyx-php

Official Telnyx PHP SDK — APIs for Voice, SMS, MMS, WhatsApp, Fax, SIP Trunking, Wireless IoT, Call Control, and more. Build global communications on Telnyx's private carrier-grade network.

36826.2k2](/packages/telnyx-telnyx-php)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)