Eight online tools for supply-chain and identity formats

k2gl.com now has a tools section: eight small pages where you paste a
signature artifact and get it decoded — and, where it's meaningful, actually
verified, not just pretty-printed. One design decision drives all of them: the
tool output is the package output. Each page calls the same open-source PHP
packages this site documents, so what you see in the browser is exactly what
composer require gets you.

A note on privacy, since people paste real tokens into things like this: requests
are processed in memory, never stored, and request bodies are never logged. The
one tool where that isn't enough — the key converter — doesn't send your input
anywhere at all.

Sigstore, end to end

The bundle inspector takes a .sigstore.json —
cosign output, a GitHub attestation — and does full verification against the
Sigstore public-good trust root: certificate chain, transparency-log inclusion,
signature. It also decodes what's usually opaque: every Fulcio certificate
extension (which workflow signed, at which commit, triggered by what), the log
entries, the in-toto payload. As far as we know there was no online tool for
this before — the alternative was cosign and jq.

Underneath a bundle sit two more formats with tools of their own: the
provenance viewer renders in-toto statements and SLSA
provenance (v1 and v0.2), and the DSSE debugger shows an
envelope's payload and its exact PAE pre-authentication encoding — the bytes
that actually get signed, and the thing to compare when two implementations
disagree.

The Composer attestation checker closes the
loop: type any vendor/package and it downloads the exact dist zip Composer
would install, hashes it, and verifies GitHub's build attestation for that
digest — the same check k2gl/composer-attest runs
at install time. Expect "no attestation" a lot: when we ran the 500 most popular
Packagist packages through it, none shipped one. Publishing provenance is
one workflow line; the ecosystem just hasn't
started yet.

Identity formats

The SD-JWT debugger takes an RFC 9901 token apart:
every disclosure with its recomputed digest (stray disclosures the issuer never
committed to get flagged), the recreated claim set, the key-binding JWT, and
signature verification against an issuer key. Its counterpart, the
generator, issues a demo SD-JWT with the claims you
choose disclosable, signed by a throwaway key — generate in one tab, dissect in
the other. Context on why these formats matter now:
digital identity for PHP.

Two more

The SSH signature verifier covers both OpenSSH modes for
SSHSIG blocks (ssh-keygen -Y sign, SSH-signed git commits): signature-only
integrity, or the full allowed_signers check with principal and namespace.

The PEM ⇄ JWK converter is deliberately the odd one out:
it runs entirely in your browser via WebCrypto, because a tool people paste
private keys into has no business having a server side. RSA, EC, Ed25519,
both directions.

How they're built

A small PHP API (FrankenPHP) behind the site runs the packages themselves;
verification failures come back as results, not errors — a failed check is
information. The pages are plain HTML forms with a little vanilla JS. If you'd
rather have the same capabilities in your own code, every tool page shows the
few lines of PHP that do the equivalent, with links to the packages.

Start with the tools index — or go straight to
verifying your dependencies.