security-txt

This package provides a complete PHP solution for working with the security.txt format defined in RFC 9116. It enables developers to programmatically create security.txt files, parse existing ones, and perform comprehensive validation of their contents and placement on a host. Key capabilities include: - **Generation**: Build a SecurityTxt object, add contacts, acknowledgments, preferred languages, expiration dates, and other fields, then output a correctly formatted text file. - **Parsing**: Load security.txt from a string, a fetched result, or a remote URL, extracting all fields and detecting malformed lines. - **Validation**: Verify that a security.txt file meets the specification, checking mandatory fields, correct URLs, HTTPS usage, signature coverage, redirects, and more. Validation can be performed on local content or by fetching from a host, with detailed error and warning reports. - **Signature Support**: Create OpenPGP cleartext signatures programmatically (requires gnupg extension) or use pre‑signed static files. The library validates signatures but does not verify key trust, leaving that to the researcher. - **CLI Tool**: A command‑line script (`checksecuritytxt.php`) allows quick validation of any host, useful in CI pipelines or GitHub Actions. - **JSON Serialization**: Results from validation or fetching can be encoded to JSON for caching, serverless processing, or inter‑process communication, with version‑controlled format handling. - **Fetching Controls**: Secure fetching with strict restrictions (HTTPS only, IP validation, redirect limits, size limits, custom DNS providers, and user‑agent customization). - **Caching**: Example integrations with Symfony and Nette caches enable signing and serving security.txt files without recomputing on each request. The library is designed for both server‑side integration and command‑line usage, providing extensive configuration options (strict mode, warning thresholds, IPv6 handling, etc.) while maintaining a clean, object‑oriented API. It supports PHP 8.5 and higher, with optional extensions for curl and gnupg to enable remote fetching and signature verification.