- How do I install attachmentav/virus-scan-sdk in a Laravel app?
- Install it with Composer using composer require attachmentav/virus-scan-sdk. The SDK requires PHP 8.0 or newer and any PSR-18 HTTP client, so make sure your Laravel project has a compatible PSR-18 implementation. After installation, wrap the SDK in an application service and add configuration for credentials and scan options. The overview mentions Laravel integration but not a specific service provider, so verify what is included before relying on framework auto-discovery.
- What can I scan with the attachmentAV Virus Scan SDK?
- The SDK scans files, URLs, and S3 objects for viruses, trojans, ransomware, and other malware through the attachmentAV API powered by Sophos. It fits use cases such as user uploads, email attachments, and document ingestion pipelines before content is stored or forwarded. It supports both SaaS and self-hosted on AWS deployments.
- Does the SDK support synchronous and asynchronous virus scans?
- Yes, the overview states that it supports sync and async scans. Synchronous scans fit low-latency checks, while asynchronous scans are better for large files or queue-based workflows. It also includes callback verification, which helps when scan results arrive through a callback. In Laravel, pair async scans with queued jobs and persist the resulting verdicts.
- Which PHP and Laravel versions does this package support?
- The SDK requires PHP 8.0 or newer. The supplied overview does not list a specific Laravel version matrix, so check the Composer constraints and test against your supported Laravel release before adoption. Because the package is at v1.0.0, pin it and review changelog and release notes for breaking changes.
- Do I need Guzzle or a specific HTTP client for attachmentav/virus-scan-sdk?
- The SDK works with any PSR-18 HTTP client, so it is not tied to a specific Guzzle version. In Laravel, ensure that a PSR-18-compatible client is installed and configured. If you need custom timeouts, retries, or logging, configure those in your HTTP client or wrap SDK calls in application code.
- Is there a Laravel service provider or facade for this SDK?
- The overview mentions Laravel integration but does not confirm a publishable config, service provider, or facade. Treat the SDK as a vendor adapter and create an application-owned service or interface around it. That keeps controllers and jobs independent of vendor classes and lets you add configuration, logging, retries, and metrics.
- How should I handle scan verdicts like clean, infected, failed, and unknown?
- Define an application-level verdict enum or value object that maps the attachmentAV response into clean, infected, failed, and unknown states. Keep the raw SDK response for audit and debugging, but let domain code depend on your own types. Treat failed and unknown as non-clean outcomes and route them to quarantine, manual review, or retry policies. Test all verdict branches with sandbox credentials.
- What production concerns should I consider before using attachmentAV scanning?
- Consider external-service dependency, upload latency, file-size and time limits, API quota and rate limits, data residency and privacy obligations, and the vendor SLA. Plan for timeouts, retries, credential rotation, API outages, scan failures, and quarantine handling. Run a bounded pilot and measure latency and error rates before expanding. Keep scanning behind a feature flag during rollout.
- How do I test the attachmentAV SDK in a Laravel application?
- Use sandbox credentials and integration tests for clean, infected, timeout, quota, and malformed-response cases. Wrap the SDK behind an interface so you can fake or mock it in unit tests. Test queued jobs, retry behavior, and callback verification separately. The overview does not mention Laravel-specific testing helpers, so plan to build your own test utilities.
- What alternatives exist, and is this package a good fit?
- Alternatives include other malware scanning APIs, self-hosted scanners such as ClamAV, or building directly against the attachmentAV API. This package is a good fit when you want a Composer-installable SDK for attachmentAV rather than maintaining scanning infrastructure. It is less ideal if you need a fully Laravel-native package with publishable config, facade, and framework-integrated testing helpers. Evaluate vendor lock-in, SLA, data retention, and licensing before choosing it.