Lumos Laravel Package

Product Decisions This Supports

• Feature scoping: The 1.1.0 release adds symmetric GPG decryption support, enabling Laravel applications to decrypt GPG-protected payloads using a shared passphrase rather than only asymmetric key pairs. This supports product decisions around secure file exchange, partner/vendor data ingestion, and internal encrypted artifact workflows.
• Build vs. buy: Teams can use this package instead of building custom GPG command wrappers or maintaining low-level decryption code in-house, reducing initial delivery time and crypto-specific maintenance burden.
• Roadmap fit: Useful for roadmap items involving PGP/GPG interoperability, secure batch imports, encrypted backups, or compliance-driven data handling where counterparties use GPG.
• Use-case validation: Symmetric decryption is best suited to trusted shared-secret workflows; it is less appropriate where per-recipient key management, auditability, or non-repudiation are required.

When to Consider This Package

• Consider it when a Laravel/PHP product needs to decrypt GPG-encrypted files or payloads and wants an application-level integration rather than shelling out to GPG directly.
• It is especially relevant if the workflow uses symmetric GPG encryption/decryption with a shared passphrase, such as exchanging encrypted files with a trusted partner or processing internally encrypted artifacts.
• Evaluate it when the team values faster delivery over building and owning custom GPG handling, and when the security model tolerates application-managed secrets.
• Look elsewhere or plan additional controls if you need hardware-backed key management, HSM/KMS integration, per-tenant key isolation, advanced key rotation, full PGP key server integration, streaming decryption for very large files, or formal audit/compliance features beyond the package’s scope.
• Before adoption, confirm Laravel/PHP version compatibility, license, maintenance activity, test coverage, error handling, and how passphrases/keys are stored and rotated. The jump from 0.2.0 to 1.1.0 should also prompt a review of the full changelog for intermediate changes.

How to Pitch It (Stakeholders)

Executive summary: The package now supports symmetric GPG decryption, expanding its usefulness for secure data-exchange workflows in Laravel applications. Adopting it can reduce custom cryptography work and speed delivery of encrypted-file ingestion features, while keeping implementation inside the application stack.

Engineering summary: 1.1.0 adds symmetric GPG decryption support. This gives us a package-level option for shared-passphrase GPG workflows instead of maintaining our own GPG command wrappers. Recommend a short technical spike to validate compatibility, secret handling, error behavior, and operational fit before committing it to a roadmap item.