PHPackages                             k2gl/sigstore-sign - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. k2gl/sigstore-sign

ActiveLibrary[Utility & Helpers](/categories/utility)

k2gl/sigstore-sign
==================

Sign artifacts and attestations with Sigstore from PHP — sign, log to Rekor, timestamp, and assemble a bundle

1.1.5(1mo ago)01761MITPHPPHP >=8.1CI passing

Since Jul 4Pushed 1mo agoCompare

[ Source](https://github.com/k2gl/sigstore-sign)[ Packagist](https://packagist.org/packages/k2gl/sigstore-sign)[ Docs](https://github.com/k2gl/sigstore-sign)[ RSS](/packages/k2gl-sigstore-sign/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (11)Versions (8)Used By (1)

Sign with Sigstore from PHP
===========================

[](#sign-with-sigstore-from-php)

[![CI](https://camo.githubusercontent.com/c2b163693c24eba2769ef5fa52878a5aafe133c8a4e003bef6fcccb9e54ad185/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6b32676c2f73696773746f72652d7369676e2f63692e796d6c3f6272616e63683d6d61696e266c6162656c3d4349266c6f676f3d676974687562)](https://github.com/k2gl/sigstore-sign/actions/workflows/ci.yml)[![Latest Stable Version](https://camo.githubusercontent.com/01d427b17948399bb7b4c4494afde4218ca48657433581e46762c2fb81dc5c20/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6b32676c2f73696773746f72652d7369676e3f6c6f676f3d7061636b6167697374266c6f676f436f6c6f723d7768697465)](https://packagist.org/packages/k2gl/sigstore-sign)[![PHPStan Level](https://camo.githubusercontent.com/01c58e66f2fafb70c17613ff2b1da3f549aade3a735b076da5cd9e5c04b945a5/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048505374616e2d6c6576656c253230392d3261356561373f6c6f676f3d706870266c6f676f436f6c6f723d7768697465)](https://phpstan.org)[![License](https://camo.githubusercontent.com/fba416db8e425fae4d472350e18949357a602cf0e9e0e5492bdf271500699404/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f6b32676c2f73696773746f72652d7369676e3f636f6c6f723d79656c6c6f77677265656e)](https://packagist.org/packages/k2gl/sigstore-sign)

The Sigstore signing flow, end to end, in PHP: **sign** an artifact or an attestation, **log** the entry to a Rekor v2 transparency log, **timestamp** the signature, and **assemble** the `.sigstore.json` bundle — the emit counterpart to [`k2gl/sigstore-verify`](https://github.com/k2gl/sigstore-verify).

It ties the family together: [`k2gl/dsse`](https://github.com/k2gl/dsse) signs, [`k2gl/rekor-client`](https://github.com/k2gl/rekor-client) logs, [`k2gl/sigstore-bundle`](https://github.com/k2gl/sigstore-bundle) is emitted. It does both **keyful** signing (you bring the key and its certificate or a public-key hint) and **keyless** signing (an ephemeral key certified by Fulcio against a CI OIDC identity).

Requirements
------------

[](#requirements)

- PHP 8.1+
- A PSR-18 HTTP client and PSR-17 factory (for Rekor and the timestamp authority)
- `k2gl/dsse`, `k2gl/rekor-client`, `k2gl/sigstore-bundle`

Installation
------------

[](#installation)

```
composer require k2gl/sigstore-sign
```

Usage
-----

[](#usage)

```
use K2gl\Dsse\EcdsaP256Signer;
use K2gl\RekorClient\{RekorClient, KeyDetails};
use K2gl\SigstoreSign\{SigstoreSigner, SigningKey, TsaClient};

$rekor = new RekorClient($psr18, $psr17, $psr17, 'https://rekor.sigstore.dev');
$tsa   = new TsaClient($psr18, $psr17, $psr17, 'https://timestamp.sigstore.dev');
$signer = new SigstoreSigner($rekor, $tsa);

// The key: a DSSE signer for the private half, plus the public half — here a
// public-key hint (or use SigningKey::certificate() with a Fulcio leaf).
$key = SigningKey::publicKey(
    signer:     EcdsaP256Signer::fromPem(file_get_contents('signing-key.pem'), null),
    publicKeyDer: $publicKeyDer,
    keyDetails: KeyDetails::PKIX_ECDSA_P256_SHA_256,
    hint:       $hexSha256OfThePublicKey,
);

// Sign an artifact → a message-signature bundle.
$bundleJson = $signer->signArtifact(file_get_contents('release.tar.gz'), $key)->toJson();

// …or sign an attestation payload (e.g. an in-toto Statement) → a DSSE bundle.
$bundleJson = $signer->signAttestation($statementJson, 'application/vnd.in-toto+json', $key)->toJson();
```

### Keyless signing (Fulcio + CI OIDC)

[](#keyless-signing-fulcio--ci-oidc)

In CI, sign without a long-lived key: read the ambient OIDC identity, let Fulcio certify an ephemeral key against it, and sign with that.

```
use K2gl\SigstoreSign\{AmbientCredentials, FulcioClient, FulcioSigningKey, SigstoreSigner};

// The CI identity token (GitHub Actions needs `id-token: write`).
$oidcToken = AmbientCredentials::githubActions($psr18, $psr17);
// …or AmbientCredentials::gitlabCi() for a GitLab id_token.

$fulcio = new FulcioClient($psr18, $psr17, $psr17, 'https://fulcio.sigstore.dev');
$key = FulcioSigningKey::create($fulcio, $oidcToken); // ephemeral key + Fulcio certificate

$bundleJson = (new SigstoreSigner($rekor, $tsa))->signArtifact($artifact, $key)->toJson();
```

`FulcioSigningKey` generates the ephemeral P-256 key, proves possession of it to Fulcio by signing the token's `sub`, and returns a `SigningKey` bound to the issued certificate — the same type keyful signing uses, so the rest of the flow is identical.

### Why the timestamp authority matters

[](#why-the-timestamp-authority-matters)

A Rekor v2 entry has no integrated time, so a bundle needs a trusted RFC 3161 timestamp to have a verifiable signing time. Pass a `TsaClient` (Sigstore's public-good TSA is `timestamp.sigstore.dev`) when signing against Rekor v2 — without it, the bundle logs and assembles but will not verify for lack of a time source.

### What gets signed

[](#what-gets-signed)

- **Artifact** — the signature is over the artifact's SHA-256 digest (the message-signature convention). Use an attestation for Ed25519 keys, which the message-signature path does not cover on the verify side.
- **Attestation** — the payload is wrapped in a DSSE envelope and the signature is over the PAE; the Rekor entry binds the PAE digest, as Rekor v2 records DSSE attestations.

Errors
------

[](#errors)

Everything thrown implements `K2gl\SigstoreSign\Exception\SigstoreSignException`: `SigningException` (the signing flow), `TimestampException` (the timestamp authority), and `FulcioException` (the OIDC credential or the Fulcio certificate step).

Pull requests are always welcome
--------------------------------

[](#pull-requests-are-always-welcome)

[Collaborate with pull requests](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request)

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance90

Actively maintained with recent releases

Popularity10

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity47

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

7

Last Release

48d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/6bc4aa529c7f13ea593297497f6eae20d5c07f476baa0a551960d7e6ff1e5413?d=identicon)[k2gl](/maintainers/k2gl)

---

Top Contributors

[![k2gl](https://avatars.githubusercontent.com/u/2846079?v=4)](https://github.com/k2gl "k2gl (13 commits)")

---

Tags

signingtimestamprfc3161attestationsupply-chaindssesigstorerekorcosign

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

Type Coverage Yes

### Embed Badge

![Health badge](/badges/k2gl-sigstore-sign/health.svg)

```
[![Health](https://phpackages.com/badges/k2gl-sigstore-sign/health.svg)](https://phpackages.com/packages/k2gl-sigstore-sign)
```

###  Alternatives

[tempest/framework

The PHP framework that gets out of your way.

2.3k37.6k21](/packages/tempest-framework)[flow-php/flow

PHP ETL - Extract Transform Load - Data processing framework

86337.5k](/packages/flow-php-flow)[cakephp/cakephp

The CakePHP framework

8.9k20.0M1.9k](/packages/cakephp-cakephp)[telnyx/telnyx-php

Official Telnyx PHP SDK — APIs for Voice, SMS, MMS, WhatsApp, Fax, SIP Trunking, Wireless IoT, Call Control, and more. Build global communications on Telnyx's private carrier-grade network.

36826.2k2](/packages/telnyx-telnyx-php)[typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

1.2k1.9M122](/packages/typo3-cms)[aedart/athenaeum

Athenaeum is a mono repository; a collection of various PHP packages

265.2k](/packages/aedart-athenaeum)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)