content-provenance — every piece of content with its own signature.
Ed25519-based digital signatures for TYPO3 content, cryptographically verifiable via /.well-known/provenance-keys. Plus end-to-end audit-trail logging — the foundation for EU AI Act compliance and demonstrable content integrity.
EU AI Act, deepfakes, AI-generated content: who wrote this?
With content-provenance
- Ed25519 signature per content element, stored alongside the content
- Public verification endpoint via
/.well-known/provenance-keys - Audit log with who/when/what, append-only
- DDD architecture, deptrac-checked
- EU AI Act-prepared fields (model, prompt hash, reviewer)
Until now
- "Reviewed by editorial" as a claim in the footer
- No cryptographic verifiability
- Audit trail missing or living in the SQL log
- EU AI Act requirements with no clean way to prove anything
Four building blocks
EU AI Act fields
Prepared metadata fields for AI-generated/-assisted content: model, prompt hash, human reviewer, approval timestamp.
Audit trail
Append-only audit log of every change: who, when, what, signed and timestamped. Verifiable end-to-end via the same Ed25519 keys as the content itself.
Public key endpoint
/.well-known/provenance-keys serves the active public keys for external verifiers — following the RFC convention.
Ed25519 signatures
Cryptographic signature per content element via libsodium (ext-sodium required). Key rotation and multi-key support included.
Architecture
Classes/
├── Domain/ # Signature models, key value objects, contracts
├── Application/ # Signing services, verification orchestration
├── Infrastructure/ # Key providers, repositories, API middleware
└── Presentation/ # Controllers, event listeners
API endpoints
| Endpoint | Purpose |
|---|---|
/_provenance/api/verify | Verify content signatures |
/.well-known/provenance-keys | Public key discovery |
Database tables
| Table | Purpose |
|---|---|
tx_provenance_signature | Content signatures |
tx_provenance_audit_log | Audit trail entries |
Configuration and requirements
Configure key providers and signing policies through TYPO3 site settings. Multiple key providers for different environments (development, staging, production) are supported — the backend is pluggable (file, environment, vault).
Requirements
- PHP 8.3+
- TYPO3 14.0
ext-sodium(mandatory — for Ed25519 operations)
Optional dependencies
| Package | Type | Purpose |
|---|---|---|
ext-sodium | Required | Ed25519 cryptography |
moselwal/dev | Dev | Shared QA tooling |
Source code & docs
TYPO3 Extension Repository
Not in the official TER — install via Composer only.
GitLab (source of truth)
Primary repository including CI/CD and Composer package registry.
EU AI Act readiness as a project?
content-provenance is the technical foundation. If you need an end-to-end EU AI Act compliance setup — including processes, training and audit preparation — get in touch.
Oder direkt schreiben: kontakt@moselwal.de