- How do I install apollopy/flysystem-aliyun-oss in a Laravel app?
- Install it with Composer using composer require apollopy/flysystem-aliyun-oss, then register an Aliyun OSS disk in config/filesystems.php or through a small service provider. The package is a Flysystem adapter, so it does not provide a full Laravel-native OSS integration by itself. Confirm the supported Laravel, Flysystem, PHP, and OSS SDK versions before installing in production.
- Does this package support Laravel 9, 10, and 11 with Flysystem v3?
- That is the key compatibility question to verify before adopting it. Laravel 9+ uses Flysystem v3, and the package's Flysystem major-version support is the main technical risk noted in the assessment. Check the repository's composer.json and tests, or run a non-production spike, before committing. If it only supports older Flysystem versions, consider a fork or a thin adapter over the Aliyun OSS SDK.
- How do I configure an Aliyun OSS disk in Laravel with this adapter?
- You typically add a disk entry in config/filesystems.php with the driver pointing to the adapter and provide OSS credentials, bucket, region, and endpoint settings. Because this is adapter-only integration, you may need a small service provider to register the custom driver. Validate put, get, delete, list, exists, url, and visibility operations on a non-production bucket first.
- Does it support presigned URLs and custom endpoints for Aliyun OSS?
- The assessment flags presigned URLs and custom endpoints as behaviors that need validation rather than documented guarantees. Test URL signing and custom endpoint configuration in a spike with a real OSS bucket. Confirm how signed URL expiry, credential scope, and endpoint overrides are handled before relying on them in production.
- Can I upload large files with multipart uploads using this Flysystem adapter?
- Multipart upload, streaming, and large-file behavior are listed as undocumented or unverified areas for this package. OSS itself scales, but the adapter's handling of concurrency, retries, timeouts, and memory pressure depends on its implementation. Load-test large uploads and downloads, and watch for memory pressure if the adapter buffers objects.
- How are Aliyun OSS credentials and STS/RAM tokens handled?
- Credential handling is a security review item for this package, not a documented strength. Verify whether it supports static AccessKey credentials, STS tokens, or RAM roles, and how credentials are passed to the OSS SDK. Avoid hardcoding secrets, rotate credentials, and review signed URL leakage risks before production use.
- Does this adapter support object ACLs and visibility settings?
- Visibility and ACL semantics are called out as behavior that needs testing. Flysystem exposes visibility concepts, but translating them to Aliyun OSS ACLs can vary by adapter. Test public and private visibility changes and bucket permissions on a non-production bucket, and document any differences from your current storage backend.
- Is apollopy/flysystem-aliyun-oss actively maintained?
- Adoption and maintenance signals are weak, with roughly 90 stars and a low score in the assessment. Treat it as a candidate dependency to validate, not a default enterprise choice. Plan for internal ownership, dependency pinning, CVE monitoring, and periodic Composer updates. If it is abandoned, fork the adapter or build a thin adapter over the Aliyun OSS SDK.
- How should I test this OSS adapter before using it in production?
- Start with a non-production bucket and prefix, run a Composer audit, and write integration tests for put, get, delete, list, exists, url, and visibility. Compare results against your current storage backend and test URL signing, ACL translation, custom endpoints, and error handling. Pilot only low-risk assets first with a documented rollback path.
- What are alternatives if this package is incompatible or abandoned?
- If the adapter does not support your Laravel and Flysystem versions, fork it or build a thin adapter over the Aliyun OSS SDK while keeping Laravel's Storage abstraction. Avoid bypassing Flysystem with direct SDK calls throughout the app because that increases coupling. Document an exit path and assign ownership before migrating production data.