index.html

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>provemark — verifiable trust for PHP</title>
<meta name="description" content="Open-source PHP tooling for verifiable trust: C2PA Content Credentials (content provenance, EU AI Act Article 50) and model-based property testing.">
<link rel="icon" type="image/svg+xml" href="/favicon.svg">
<link rel="icon" type="image/png" sizes="64x64" href="/favicon.png">
<link rel="apple-touch-icon" href="/apple-touch-icon.png">
<meta property="og:type" content="website">
<meta property="og:site_name" content="provemark">
<meta property="og:title" content="provemark — verifiable trust for PHP">
<meta property="og:description" content="Open-source PHP tooling for verifiable trust: C2PA Content Credentials (content provenance, EU AI Act) and model-based property testing.">
<meta property="og:url" content="https://provemark.github.io/">
<meta property="og:image" content="https://provemark.github.io/provemark-icon.png">
<meta name="twitter:card" content="summary">
<link rel="alternate" type="application/rss+xml" title="provemark" href="/feed.xml">
<link rel="stylesheet" href="/style.css">
</head>
<body>

<header class="site-header">
  <div class="inner">
    <a class="brand" href="/">
      <img class="mark" src="/favicon.png" alt="" width="22" height="22">
      provemark
    </a>
    <nav class="header-nav">
      <a href="https://github.com/provemark">GitHub</a>
    </nav>
  </div>
</header>

<main class="container">
  <section class="hero">
    <p class="eyebrow">Verifiable trust for PHP</p>
    <h1>provemark</h1>
    <p class="lede">Open-source PHP tooling for provenance and correctness — from
    <a href="https://c2pa.org">C2PA</a> Content Credentials to model-based property testing.</p>
  </section>

  <h2>Projects</h2>
  <div class="card">
    <h3><a href="https://github.com/provemark/content-credentials">content-credentials</a></h3>
    <p class="muted" style="margin:.35rem 0 0">A PHP library to build, sign, read and verify C2PA
    manifests, with machine-readable marking of AI-generated content under the EU&nbsp;AI&nbsp;Act,
    Article&nbsp;50 — a framework-agnostic core plus a Laravel integration, keeping the signing key
    isolated behind a service.</p>
    <p class="muted" style="margin:.7rem 0 0">Listed as the PHP library under <em>External projects</em>
    in the Content Authenticity Initiative's
    <a href="https://opensource.contentauthenticity.org/docs/community-resources/">community
    resources</a> — the CAI's own open-source documentation, and the only PHP entry there. That is a
    listing, not a conformance claim: the C2PA Conforming Products List names the deployments that
    sign, never the libraries they are built from.</p>
    <pre class="install"><code>composer require provemark/content-credentials</code></pre>
  </div>

  <div class="card">
    <h3><a href="https://github.com/provemark/c2pa-verifier">c2pa-verifier</a></h3>
    <p class="muted" style="margin:.35rem 0 0">A verifier for C2PA Content Credentials in pure PHP.
    It reads the manifest store out of a JPEG, PNG, GIF, WebP, WAV, AVI, MP3, FLAC or ISOBMFF file
    (MP4, MOV, AVIF, HEIC) and
    checks the claim signature, the hash binding to the asset, the certificate chain against a trust
    list you supply, the RFC&nbsp;3161 timestamp and the revocation responses a signer staples into
    its own signature — returning what <code>c2patool</code> returns: the same
    <code>validation_state</code> and the same C2PA&nbsp;2.4 §15 status codes.</p>
    <p class="muted" style="margin:.7rem 0 0">Built for hosts that can run <strong>no</strong> second
    process, <strong>no</strong> native extension and <strong>no</strong> binary — cheap shared
    hosting, where most WordPress and Drupal sites live. It does not sign, holds no keys, and opens
    no network connection while verifying.</p>
    <p class="muted" style="margin:.7rem 0 0"><strong>A first version: thoroughly tested and never
    used.</strong> Every fixture is measured against <code>c2patool</code>, its answers compared with
    a second implementation in Go and a third in Python, and 111 named obligations of the
    specification walked one by one — but nobody has yet pointed it at their own files, their own
    trust list or their own hosting. Treat a verdict as something to check, not as an answer; what is
    known to be missing is published alongside what works.</p>
    <p style="margin:.9rem 0 0"><a href="/demo/"><strong>Try it in your browser →</strong></a>
    <span class="muted">The same PHP, compiled to WebAssembly; your file never leaves your device.</span></p>
    <pre class="install"><code>composer require provemark/c2pa-verifier</code></pre>
  </div>

  <div class="card">
    <h3><a href="https://github.com/provemark/tracefern-image-check">tracefern-image-check</a></h3>
    <p class="muted" style="margin:.35rem 0 0"><strong>Tracefern Image Check for C2PA</strong>, a WordPress
    plugin that verifies the Content Credentials of every JPEG, PNG, GIF and WebP image and every
    WAV, MP3 and FLAC file uploaded to the Media Library with c2pa-verifier, and shows the verdict in a Media Library column, a filter and the
    attachment details: <em>Verified: trusted signer</em>, <em>Intact: signer not trusted</em>,
    <em>Does not verify</em>, <em>No Content Credentials</em> or <em>Could not be checked</em> — and
    <em>AI-generated (signed)</em> only when a manifest that verifies says so.</p>
    <p class="muted" style="margin:.7rem 0 0">The check runs in the background, so it never blocks or
    breaks an upload; the plugin signs nothing and makes no network calls. It is c2pa-verifier's
    first real user.</p>
    <p class="muted" style="margin:.7rem 0 0">In the WordPress.org plugin directory:
    <a href="https://wordpress.org/plugins/tracefern-image-check-for-c2pa/">Tracefern Image Check for C2PA</a>.</p>
  </div>

  <div class="card">
    <h3><a href="https://github.com/provemark/stateful-check">stateful-check</a></h3>
    <p class="muted" style="margin:.35rem 0 0">Model-based (stateful) property testing for PHP:
    generate sequences of commands, check them against a shadow model, and shrink a failure to a
    minimal counterexample. Also a stateless property runner and opt-in edge-biased generation.</p>
  </div>

  <h2>Writing</h2>
  <ul class="post-list">
    <li>
      <a href="/articles/image-plugins-and-content-credentials/">What WordPress image plugins do to Content Credentials</a>
      <span class="date">7 October 2026</span>
    </li>
    <li>
      <a href="/articles/measuring-a-verifier/">How do you know a C2PA verifier is right?</a>
      <span class="date">24 September 2026</span>
    </li>
    <li>
      <a href="/articles/article-50-deadlines/">Two Article&nbsp;50 deadlines, and which one is yours</a>
      <span class="date">12 August 2026</span>
    </li>
    <li>
      <a href="/articles/path-to-trusted/">From valid to trusted: the PHP route to production Content Credentials</a>
      <span class="date">8 August 2026</span>
    </li>
    <li>
      <a href="/articles/c2pa-gotchas/">Three things that will cost you a day with C2PA</a>
      <span class="date">6 August 2026</span>
    </li>
    <li>
      <a href="/articles/introducing-stateful-check/">Introducing stateful-check: generate programs, not values</a>
      <span class="date">3 August 2026</span>
    </li>
    <li>
      <a href="/articles/mocked-vs-real/">Mocked&nbsp;≠&nbsp;real: the bug my unit tests were hiding</a>
      <span class="date">29 July 2026</span>
    </li>
    <li>
      <a href="/articles/introducing-provemark/">Introducing provemark: C2PA Content Credentials for PHP</a>
      <span class="date">28 July 2026</span>
    </li>
    <li>
      <a href="/articles/c2pa-certificates/">Valid&nbsp;≠&nbsp;trusted: a practical guide to C2PA signing certificates</a>
      <span class="date">28 July 2026</span>
    </li>
  </ul>
</main>

<footer class="site-footer">
  <div class="inner">© 2026 provemark ·
    <a href="https://github.com/provemark">GitHub</a> ·
    <a href="https://packagist.org/packages/provemark/content-credentials">Packagist</a> ·
    <a href="/feed.xml">RSS</a>
  </div>
</footer>

</body>
</html>