Weave Code
Decompresso Laravel Package
esplora/decompresso
Decompresso is a Laravel/PHP package that simplifies working with compressed files and archives. It offers a clean, straightforward API for safe extraction, making it easy to add reliable decompression support to your application workflows with less code.
PHP library for unlocking password-protected documents and extracting archive contents.
Frequently asked questions about Decompresso
- How do I install esplora/decompresso in a Laravel application?
- Install it with Composer using composer require esplora/decompresso, then let Laravel package discovery register the service provider automatically. Publish the package config with php artisan vendor:publish and set the required environment variables for your passphrase or key path. Because the jump from 0.2.0 to 1.1.0 skips the 1.0.0 release notes, pin an exact version such as 1.1.0 rather than floating on ^1.0 until you have read the changelog.
- Which PHP and Laravel versions does Decompresso support?
- The supported PHP and Laravel ranges are defined in the package composer.json and its CI matrix, which are not visible in the release summary alone. Check those files directly before adopting, since the project crossed the 1.0 line and now asserts semver API stability. Confirm the version constraints against your application's framework version before pinning.
- What changed in Decompresso 1.1.0 and is it a breaking change?
- The only documented change in 1.1.0 is symmetric GPG decryption support via PR #7, which adds a passphrase-based unlock path alongside the existing private-key path. No deprecations or breaking changes are stated. However, the compare link jumps from 0.2.0 to 1.1.0 without aggregating the 1.0.0 notes, so treat the no-breaking-changes implication as unverified until you read CHANGELOG.md and the 1.0.0 release page.
- How does Decompresso handle password-protected archives and documents?
- Decompresso provides a clean API for unlocking password-protected files and safely extracting archive contents, so you can pass a file path and credentials and get the contents back instead of writing bespoke shell scripts. Supported formats and the exact method signatures are documented in the README, which you should review before wiring it into a workflow. Wrap extraction in your own validation so you can assert the output is what you expect.
- Does Decompresso require the gpg binary to be installed on the server?
- Yes, if you use the GPG decryption paths, gpg is a host dependency rather than a Composer dependency. Every container base image, CI runner image, and developer laptop must carry a compatible gpg version, or decryption fails in ways that typically surface only at application boot. Add gpg provisioning to your base image before doing any application-level integration work.
- What happens if the passphrase or private key is wrong when decrypting?
- The failure contract is the most important thing to verify yourself: you need to know whether a bad passphrase, missing key, or missing binary throws a loud exception or yields an empty or partial value. Silent-empty output on a secret decrypt is the dangerous case, because it turns a configuration error into an authentication failure several layers away. Wrap decryption calls and assert on non-empty output until the behavior is confirmed in code or by the maintainers.
- Can I use Decompresso to decrypt .env files or CI artifacts with a shared passphrase?
- Yes, the symmetric mode added in 1.1.0 fits scenarios where encrypted secrets live in files, deployed artifacts, or CI variables and you want decryption to happen inside the framework. The tradeoff is that symmetric mode collapses key management into one passphrase used everywhere, so you must inject it at runtime from a secret store rather than committing it, baking it into an image layer, or letting it appear in build logs. If your target is a managed secrets service such as Vault, AWS Secrets Manager, or SOPS with age, this file-and-key model is a poorer fit and adopting it now creates a migration to unwind later.
- How should I manage and rotate passphrases with Decompresso?
- No documented rotation procedure is visible in the release materials, so plan to handle rotation manually by re-encrypting artifacts with the new passphrase and updating the runtime secret store. Keep the passphrase out of the repository, the image layer, and build logs, since passphrase custody is a process risk rather than a code risk. Ask the maintainers whether a documented rotation path exists.
- Is Decompresso safe to use in production?
- The visible change is authored by a single maintainer under a small organization, so bus factor and security-review depth are the dominant long-term risks for a package that holds decryption keys. Pin an exact version, read the 1.0.0 release notes, and ask whether a security policy or disclosure process exists. Add integration tests in CI that exercise bad-passphrase and missing-key paths so failures are loud rather than silent.
- What alternatives to Decompresso exist for archives and secrets?
- For plain archive extraction, PHP's built-in ZipArchive and PharData or packages like league/flysystem-zip cover most needs without an external binary. For secrets management, SOPS with age, HashiCorp Vault, or a cloud secrets manager give you rotation and auditability that a file-and-key model does not. For GPG specifically, the gnupg PHP extension or phpseclib can be used directly, though you would be writing the wrapper Decompresso already provides.
Weaver
How can I help you explore Laravel packages today?