Plist Laravel Package

Product Decisions This Supports

• Build vs. buy on a spec-heavy format. Binary plists (bplist00) are not something to hand-roll: offset tables, object-reference graphs, UID/CF$UID types, dates anchored to 2001-01-01, UTF-16 strings, sets, and nested containers. A correct encoder/decoder is multiple sprints plus a long tail of edge cases. This library turns that into a composer require. Clear "buy" (MIT, free).
• Unblocks the Apple/MDM integration epic. Concretely enables: generating .mobileconfig configuration profiles server-side, producing OTA install manifests (itms-services://) for enterprise iOS app distribution, emitting launchd/.plist artifacts, reading and rewriting Info.plist from uploaded IPAs during build tooling, and parsing customer-supplied plists.
• Removes a platform dependency from CI/CD. Pure PHP means Linux containers can round-trip Apple artifacts. No macOS runner, no plutil, no Swift/ObjC interop — a real cost and reliability win for a Laravel CI pipeline.
• Roadmap shaping. Low effort to adopt (thin wrapper, one dependency) but opens a credible "Apple ecosystem support" line item that would otherwise require a vendor purchase or native tooling. Good candidate for a spike-sized bet rather than a funded project.
• Interop features. Round-trip fidelity between XML and binary formats enables a "convert/validate plist" utility, import of customer configuration exported from Apple Configurator, and diffing between profile versions.

When to Consider This Package

Adopt when:

• You must handle binary plists, not just XML. XML plists are trivial via SimpleXML or array-to-XML; if XML is all you need, this is overkill.
• You generate or consume Apple configuration artifacts server-side in PHP, and you want format parity rather than a one-way serializer.
• You need round-trip conversion between XML and binary, or must accept either format from users.
• You're willing to own a thin integration layer (service provider, facade, config) — this package is framework-agnostic and ships none of that.

Look elsewhere or proceed with caution when:

• Adoption signals are weak. 4 stars on this fork and 0 listed dependents is a genuine vetting gap. Verify the relationship to upstream rodneyrehm/plist, check which repo actually receives fixes, and pin an exact version.
• Security surface matters. Parsing untrusted plists means untrusted binary input; audit for object-reference cycles, allocation bombs, and depth limits, and cap upload size before decoding.
• You need more than serialization. Code signing, provisioning profile validation, and App Store Connect workflows are out of scope — this is a format library, not an Apple platform toolkit.
• XML-only use case — use a plain serializer and skip the dependency entirely.
• Laravel-native DX is a hard requirement out of the box — you will be writing the wrapper, config, and tests yourself.

Mitigation plan if adopted: wrapper + facade, one golden-file test suite covering binary/XML/date/UID/UTF-16 cases, a size and depth guard on decode, and a documented fork-and-own contingency (MIT makes this cheap).

How to Pitch It (Stakeholders)

Executives: An MIT-licensed, zero-cost PHP library that lets us generate and read Apple configuration files — .mobileconfig profiles, enterprise iOS install manifests, macOS plists — from our existing Laravel stack. It avoids buying an Apple-ecosystem vendor product and avoids standing up macOS build infrastructure, which is the expensive alternative. The risk is maintainer depth, not license or cost; MIT means we can fork and own it internally if the upstream stalls, so the downside is bounded engineering time rather than lock-in.

Engineering: Pure PHP, no extensions or native binaries, so it runs anywhere our containers run. It replaces ~1–2 sprints of binary-format work plus the ongoing edge-case tax of the bplist00 spec (offset tables, UID types, 2001-epoch dates, UTF-16). Integration cost is a thin adapter: a service provider, a facade, a pinned version, and golden-file tests for both XML and binary round-trips. Treat all decoded input as untrusted — enforce size and nesting limits at the boundary. Budget half a day for the wrapper and a day for the test fixtures; that's the whole adoption cost.