provemark

content-credentials

A PHP library to build, sign, read and verify C2PA manifests, with machine-readable marking of AI-generated content under the EU AI Act, Article 50 — a framework-agnostic core plus a Laravel integration, keeping the signing key isolated behind a service.

Listed as the PHP library under External projects in the Content Authenticity Initiative's community resources — the CAI's own open-source documentation, and the only PHP entry there. That is a listing, not a conformance claim: the C2PA Conforming Products List names the deployments that sign, never the libraries they are built from.

composer require provemark/content-credentials

c2pa-verifier

A verifier for C2PA Content Credentials in pure PHP. It reads the manifest store out of a JPEG, PNG, WebP or ISOBMFF file (MP4, MOV, AVIF, HEIC) and checks the claim signature, the hash binding to the asset, the certificate chain against a trust list you supply, the RFC 3161 timestamp and the revocation responses a signer staples into its own signature — returning what c2patool returns: the same validation_state and the same C2PA 2.4 §15 status codes.

Built for hosts that can run no second process, no native extension and no binary — cheap shared hosting, where most WordPress and Drupal sites live. It does not sign, holds no keys, and opens no network connection while verifying.

A first version: thoroughly tested and never used. Every fixture is measured against c2patool, its answers compared with a second implementation in Go and a third in Python, and 111 named obligations of the specification walked one by one — but nobody has yet pointed it at their own files, their own trust list or their own hosting. Treat a verdict as something to check, not as an answer; what is known to be missing is published alongside what works.

Try it in your browser → The same PHP, compiled to WebAssembly; your file never leaves your device.

composer require provemark/c2pa-verifier

stateful-check

Model-based (stateful) property testing for PHP: generate sequences of commands, check them against a shadow model, and shrink a failure to a minimal counterexample. Also a stateless property runner and opt-in edge-biased generation.