PHP tooling for verifiable trust — from the provenance and authenticity of content to the correctness of code.

A PHP library to build, sign, read and verify C2PA manifests — a framework-agnostic Core plus an optional Laravel integration, with machine-readable marking of AI-generated content under the EU AI Act, Article 50. The private signing key stays isolated from your web application, not baked into it.

composer require provemark/content-credentials

A verifier for C2PA Content Credentials in pure PHP. It reads the manifest store out of a JPEG, PNG, WebP or ISOBMFF file (MP4, MOV, AVIF, HEIC) and checks the claim signature, the hash binding to the asset, the certificate chain against a trust list you supply, the RFC 3161 timestamp and the revocation responses a signer staples into its own signature — returning what c2patool returns: the same validation_state and the same C2PA 2.4 §15 status codes.

For hosts that can run no second process, no native extension and no binary — cheap shared hosting, where most WordPress and Drupal sites live. It does not sign, holds no keys, and opens no network connection while verifying.

A first version: thoroughly tested and never used. Every fixture is measured against c2patool, its answers compared with a second implementation in Go and a third in Python, and 111 named obligations of the specification walked one by one — but nobody has yet pointed it at their own files, their own trust list or their own hosting. Treat a verdict as something to check, not as an answer. Not on Packagist yet.

Model-based (stateful) property testing for PHP: generate sequences of commands, check them against a shadow model, and shrink a failure to a minimal counterexample. Also a stateless property runner and opt-in edge-biased generation. No runtime dependencies.