- How do I install h2entwicklung/sign-checker in a Laravel application?
- Install it with Composer using composer require h2entwicklung/sign-checker, then let Laravel's package discovery register the service provider, or add it manually if discovery is disabled. Publish the package configuration with php artisan vendor:publish and select the sign-checker provider or tag shown in the package docs. Set your verification keys or trust material in that config file. Because it ships as a normal Composer library, no separate daemon or infrastructure is required.
- What does h2entwicklung/sign-checker actually verify?
- It is scoped to cryptographic signature checking: confirming that a signature over a payload matches the expected key and that the data has not been tampered with. The package overview lists signed payloads, webhooks, and tokens as intended use cases. The exact container formats, such as detached CMS, PDF/PAdES, or XML signatures, are not documented in the available material, so confirm your format is supported before committing to it. If you need certificate-chain building, revocation, or timestamp validation, treat that as a separate question for the maintainer.
- Does h2entwicklung/sign-checker support Laravel 11 and PHP 8.3?
- The only release referenced here is dated 2023-12-20, which predates Laravel 11, so compatibility is not guaranteed. Check the composer.json constraints for illuminate/support and php before installing, and run your test suite on the target version. If the constraints block Laravel 11 you can often widen them locally, but that shifts maintenance onto you. Re-evaluate the package at each framework upgrade.
- How do I configure verification keys for h2entwicklung/sign-checker?
- Configuration is handled through the package's published config file, which you populate with the public keys or trust material used during verification. After publishing, read those values through Laravel's config repository rather than hardcoding them in controllers. Keep secrets in environment variables and never commit production keys to the repository. The exact option names are package-specific, so the published config comments are the source of truth.
- Can I use h2entwicklung/sign-checker to validate incoming webhook signatures?
- The package overview explicitly lists webhook payloads among its use cases, so verifying incoming webhook signatures is a reasonable fit. Wrap the check in a small service or middleware so controllers only handle payloads that passed verification, and reject failed requests with a 4xx response. For plain HMAC-SHA256 webhooks, PHP's hash_hmac and hash_equals are often sufficient without an extra dependency. Use the package when you want the check centralized behind Laravel's container and config.
- What happens when a signature is invalid or missing in h2entwicklung/sign-checker?
- The package is described as producing clear failures when a signature is invalid or missing, which is the behavior you want, since verification should never silently pass. Catch the failure at your boundary and treat the payload as untrusted rather than continuing the workflow with unverified contents. Log the rejection with enough context to investigate, but avoid logging payloads that contain sensitive data. Make sure your integration cannot swallow the exception and fail open.
- How should I test signature verification with h2entwicklung/sign-checker?
- Build a fixture corpus and assert the package's verdicts against a trusted reference implementation. Include known-good signatures, tampered bytes, expired certificates, revoked certificates, missing signatures, and timestamp edge cases, and compare results with openssl cms -verify or pdfsig. This differential testing is the main integration effort for a security-critical dependency. Put the corpus in CI so any dependency bump that changes a verdict fails the build.
- Is h2entwicklung/sign-checker safe to use in production for signature validation?
- It is a legitimate Laravel package for cryptographic signature checks, but it has limited external scrutiny, with a single release, no dependents, and no visible community, so treat it as security-critical code you are adopting on trust. Verify its verdicts against a reference implementation before relying on it, and wrap it behind your own interface so you can swap it out. Do not treat a passing result as legal or compliance-grade evidence unless the package actually performs chain building, revocation, and timestamp validation. For legally defensible verdicts, keep a validated reference validator in the loop.
- What are the alternatives to h2entwicklung/sign-checker for Laravel apps?
- For HMAC-style webhook signatures, Laravel's built-in hash_hmac and hash_equals cover most needs with no extra dependency. For CMS or PDF signatures, OpenSSL functions and command-line tools such as openssl cms -verify and pdfsig provide a reference implementation. For PAdES or CAdES compliance work, commercial validators handle chain building, revocation, and timestamps that a lightweight package will not. Choose this package only when its supported formats and semantics match what you actually need to verify.
- Is h2entwicklung/sign-checker actively maintained?
- The available information shows a single release dated 2023-12-20 from one maintainer organisation, with no visible community or dependents, so active maintenance is not established. Ask the maintainer about the supported Laravel and PHP matrix, SemVer policy, and security disclosure process before adopting it. If those answers are not available, plan to vendor the code or wrap it behind an interface you control. Re-check the repository before each major Laravel upgrade.