PHPackages                             k2gl/sigstore-bundle - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. k2gl/sigstore-bundle

ActiveLibrary[Utility & Helpers](/categories/utility)

k2gl/sigstore-bundle
====================

Build Sigstore bundles (.sigstore.json) in PHP — the counterpart to verification, emitting DSSE and message-signature bundles

1.0.1(1mo ago)0561↑146.7%2MITPHPPHP >=8.1CI passing

Since Jul 4Pushed 1mo agoCompare

[ Source](https://github.com/k2gl/sigstore-bundle)[ Packagist](https://packagist.org/packages/k2gl/sigstore-bundle)[ Docs](https://github.com/k2gl/sigstore-bundle)[ RSS](/packages/k2gl-sigstore-bundle/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (5)Versions (3)Used By (2)

Build Sigstore bundles in PHP
=============================

[](#build-sigstore-bundles-in-php)

[![CI](https://camo.githubusercontent.com/78e8540b082d601f0b1a62e7fb4816af1ecaa534c6c8d676df88f3629c3ca165/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6b32676c2f73696773746f72652d62756e646c652f63692e796d6c3f6272616e63683d6d61696e266c6162656c3d4349266c6f676f3d676974687562)](https://github.com/k2gl/sigstore-bundle/actions/workflows/ci.yml)[![Latest Stable Version](https://camo.githubusercontent.com/1177ccc78b665db8625da77fb00426b861a9bf0bdb20cd3476b5f31d3ec2e04d/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6b32676c2f73696773746f72652d62756e646c653f6c6f676f3d7061636b6167697374266c6f676f436f6c6f723d7768697465)](https://packagist.org/packages/k2gl/sigstore-bundle)[![PHPStan Level](https://camo.githubusercontent.com/01c58e66f2fafb70c17613ff2b1da3f549aade3a735b076da5cd9e5c04b945a5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230392d3261356561373f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://phpstan.org)[![License](https://camo.githubusercontent.com/60c58e0cdb1101cb1172ca64ff9a58e5d3bbeabaaee17de1ce4c4aea1fb384c5/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6b32676c2f73696773746f72652d62756e646c653f636f6c6f723d79656c6c6f77677265656e)](https://packagist.org/packages/k2gl/sigstore-bundle)

Assemble a Sigstore bundle — the `.sigstore.json` that cosign, gitsign and npm/PyPI provenance emit — from PHP. This is the counterpart to verification: hand it the pieces you already have (a signature or DSSE envelope, the Fulcio certificate, the Rekor entry) and it lays them out as the canonical **v0.3** JSON that verifiers accept.

It does no signing and no network I/O — it is the format layer. The signature, the certificate and the transparency-log entry come from elsewhere (your signer, Fulcio, Rekor); this package places them in a well-formed bundle.

Requirements
------------

[](#requirements)

- PHP 8.1+
- [`k2gl/dsse`](https://github.com/k2gl/dsse) (for the DSSE envelope content)

Installation
------------

[](#installation)

```
composer require k2gl/sigstore-bundle
```

Usage
-----

[](#usage)

### A DSSE-attestation bundle

[](#a-dsse-attestation-bundle)

```
use K2gl\SigstoreBundle\BundleBuilder;
use K2gl\SigstoreBundle\InclusionProof;
use K2gl\SigstoreBundle\TransparencyLogEntry;

$rekorEntry = new TransparencyLogEntry(
    logIndex: 148_384_212,
    logId: $logKeyIdBytes,
    kind: 'dsse',
    version: '0.0.2',
    canonicalizedBody: $canonicalBodyBytes,
    inclusionProof: new InclusionProof(
        logIndex: 148_384_212,
        rootHash: $rootHashBytes,
        treeSize: 148_384_213,
        hashes: $siblingHashBytes,       // list of raw hashes, bottom to top
        checkpoint: $signedCheckpoint,   // the signed note string
    ),
);

$json = BundleBuilder::forDsse($envelope)   // a K2gl\Dsse\Envelope you signed
    ->withCertificate($fulcioLeafDer)       // raw DER of the Fulcio leaf
    ->addTransparencyLogEntry($rekorEntry)
    ->toJson();

file_put_contents('artifact.sigstore.json', $json);
```

### An artifact-signature bundle

[](#an-artifact-signature-bundle)

```
use K2gl\SigstoreBundle\BundleBuilder;
use K2gl\SigstoreBundle\HashAlgorithm;
use K2gl\SigstoreBundle\MessageSignature;

$signature = new MessageSignature(
    algorithm: HashAlgorithm::SHA2_256,
    digest: $artifactSha256,   // raw 32-byte digest
    signature: $rawSignature,  // raw signature over the artifact
);

$json = BundleBuilder::forMessageSignature($signature)
    ->withCertificate($fulcioLeafDer)
    ->addTransparencyLogEntry($rekorEntry)
    ->addRfc3161Timestamp($rfc3161TokenDer) // optional trusted timestamp
    ->toJson();
```

### Signing identity

[](#signing-identity)

Pick one, matching how the artifact was signed:

- `->withCertificate($der)` — a single Fulcio leaf certificate (the keyless default).
- `->withCertificateChain([$leaf, $intermediate, $root])` — a full X.509 chain.
- `->withPublicKey($hint)` — a key-based identity; the bundle only names the key by hint.

Compatibility
-------------

[](#compatibility)

The output is byte-for-byte the same structure the reference tooling emits: the test suite rebuilds real cosign/GitHub v0.3 bundles (DSSE, message signature, and with an RFC 3161 timestamp) from their components and checks the result is identical. Bundles built here verify with [`k2gl/sigstore-verify`](https://github.com/k2gl/sigstore-verify)and with `cosign`.

Pull requests are always welcome
--------------------------------

[](#pull-requests-are-always-welcome)

[Collaborate with pull requests](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request)

###  Health Score

42

—

FairBetter than 88% of packages

Maintenance90

Actively maintained with recent releases

Popularity16

Limited adoption so far

Community10

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~1 days

Total

2

Last Release

48d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/6bc4aa529c7f13ea593297497f6eae20d5c07f476baa0a551960d7e6ff1e5413?d=identicon)[k2gl](/maintainers/k2gl)

---

Top Contributors

[![k2gl](https://avatars.githubusercontent.com/u/2846079?v=4)](https://github.com/k2gl "k2gl (9 commits)")

---

Tags

bundlesigningattestationsupply-chainprovenancedssein-totosigstorerekorcosign

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

Type Coverage Yes

### Embed Badge

![Health badge](/badges/k2gl-sigstore-bundle/health.svg)

```
[![Health](https://phpackages.com/badges/k2gl-sigstore-bundle/health.svg)](https://phpackages.com/packages/k2gl-sigstore-bundle)
```

###  Alternatives

[pentatrion/vite-bundle

Vite integration for your Symfony app

2827.5M30](/packages/pentatrion-vite-bundle)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)