- Is sidus/encryption-bundle compatible with Laravel?
- No. It is a Symfony bundle built around Symfony dependency injection and Doctrine ORM lifecycle events, not a Laravel package. Laravel's Eloquent has no equivalent hydration-stage interceptor, so there is no supported way to install it in a Laravel app. Treat it as a design reference for encrypted casts and envelope keys, not as a dependency.
- How do I install sidus/encryption-bundle?
- It is installed with Composer into a Symfony application and registered as a bundle, then configured with keys and ciphers through bundle configuration. The provided context describes simple registration and setup in existing Symfony apps but does not include exact commands. There is no Laravel installation path because the bundle depends on Symfony and Doctrine.
- What does sidus/encryption-bundle do for Doctrine entities?
- It hooks Doctrine ORM lifecycle events such as postLoad, prePersist, and preUpdate to encrypt and decrypt mapped fields transparently. An EncryptionKey entity stores key material alongside ciphertext, and application code keeps using normal entity properties. The bundle's contribution is the Doctrine integration layer, not the cryptography itself.
- Can I use sidus/encryption-bundle with Eloquent?
- No. There is no Eloquent analogue to Doctrine hydration events, and casts, observers, and mutators cover different lifecycle points. They also miss DB::table(), chunked iteration, and raw query results uniformly. Making it fit Laravel would mean adopting Doctrine ORM via laravel-doctrine/orm for a single feature, which is a dual-ORM persistence layer for a narrow control.
- What are the security concerns with sidus/encryption-bundle?
- The default key model stores key rows in the same database as the ciphertext, so a database or backup dump exposes both. Decryption at hydration puts plaintext into every model instance, toArray(), JSON responses, logs, queue payloads, and caches. Non-deterministic ciphertext also breaks equality queries, unique constraints, sorting, LIKE, and reporting.
- Does sidus/encryption-bundle support key rotation?
- There is no evident envelope encryption or re-wrap story in the bundle, so rotation is not a built-in workflow. Re-encrypting a table becomes a bespoke, resumable migration project. A Laravel implementation should use per-record data keys wrapped by a KMS master key from day one.
- Is sidus/encryption-bundle maintained and compatible with PHP 8.2 and Symfony 6?
- No active maintenance is evident: the context cites 2 stars, 0 dependents, a single maintainer, and a health score of 0.13. It also targets PHP 5.6/7.x-era and Doctrine DBAL/ORM 2.x assumptions, making it near-certain to be incompatible with PHP 8.2+, Doctrine 3.x, and Symfony 6+. Adoption effectively means forking cryptographic code with no CVE watch or issue triage.
- What license does sidus/encryption-bundle use?
- The license is GPL-2.0. Internal SaaS use that never distributes the software is generally defensible, but on-prem appliances, SDKs, or redistributable artifacts force GPL on surrounding work. Legal review is a gate, and it applies to copied source, not to independently written implementations of the pattern.
- How should I test encrypted fields in Laravel if I reimplement this pattern?
- There is no Laravel testing path for this bundle. If you reimplement the pattern, test a custom cast with known plaintext and ciphertext vectors, assert ciphertext differs per record, and verify HMAC blind-index queries where searchability is required. Also test key rotation and failure modes such as a missing KMS key.
- What are Laravel alternatives to sidus/encryption-bundle?
- The recommended Laravel alternative is a native EncryptedCast using sodium_crypto_secretbox or AES-256-GCM with envelope encryption, plus a Flysystem decorator for files and an HMAC blind-index column for searchable fields. The bundle is a specification, not your code. A Laravel-native equivalent is roughly 200 to 400 lines and avoids the GPL, Doctrine, and maintenance risks.