Weave Code
Archive Tar Laravel Package
pear/archive_tar
Archive_Tar is a PHP package for creating, listing, extracting, and adding to tar files, with optional gzip, bz2, and Lzma2/xz compression support when the corresponding PHP extensions are loaded.
At a glance
Frequently asked questions about Archive Tar
- What is pear/archive_tar used for?
- pear/archive_tar is a PHP package for creating, listing, extracting, and adding to tar archives. It can optionally use gzip, bz2, and Lzma2/xz compression when the zlib, bz2, or xz PHP extensions are loaded. It is a single global-namespace class with PEAR heritage, not a Laravel package, so it provides no service provider, config, facade, or contracts.
- Can I install pear/archive_tar with Composer in a Laravel app?
- Yes. It is published on Packagist and Composer itself depends on pear/archive_tar for tar handling, so it is Composer-installable. The catch is that it does not use PSR-4 autoloading, so consuming it in a Laravel app requires classmap or include-path wiring, or a require inside a wrapper service class. It is installable but not idiomatically integrable.
- Does pear/archive_tar have a Laravel service provider or facade?
- No. It has no service provider, no config file, no facade, no contracts, and no participation in Illuminate\Filesystem or Flysystem. Using it in Laravel means writing a thin service wrapper yourself. That wrapper is an acceptable pattern, but you get zero framework leverage from the package.
- Is pear/archive_tar compatible with Laravel 11 and PHP 8.2, 8.3, and 8.4?
- There is no Laravel version constraint to check because the package has no Laravel integration; compatibility depends on the PHP runtime. PHP 8.x support is asserted, but the available release notes for 1.6.0 only document dropping PHP 5.4 and 5.5, so verify the CI matrix for 8.2, 8.3, and 8.4 before relying on it. Treat it as plain PHP code inside a wrapper rather than a Laravel-native dependency.
- Is pear/archive_tar safe for extracting untrusted user uploads?
- Treat untrusted archives as the dominant hazard. The package has a recurring extraction-path security history, including CVE-2021-32610 for symlink traversal fixed in 1.4.14, plus traversal, symlink, and phar:// fixes in 1.4.4, 1.4.6, and 1.4.13. If you must use it, pin at least 1.4.14, reject symlinks, and confine extraction to a controlled root directory. For user or third-party archives, prefer a more defensible extraction path.
- How does pear/archive_tar handle large tar files and memory limits?
- The 1.6.0 big file support work, PR #51, is an improvement rather than a streaming rewrite. Whole-file buffering remains, so large archives are a hard failure mode in FPM requests and queue workers. If you need streaming semantics, this package is not the right tool; plan for system tar via symfony/process or another streaming approach.
- What are the best Laravel alternatives to pear/archive_tar?
- For most Laravel apps, PharData is the built-in zero-dependency option, and ZipArchive covers zip archives. Flysystem adapters handle storage abstractions, and symfony/process plus system tar is a practical streaming option. The real gap pear/archive_tar fills is narrow: legacy tar variants, in-memory tar strings, prefixing, and incremental add. Define your use case before adding a dependency.
- How do I wrap pear/archive_tar cleanly in a Laravel service?
- Define ArchiveWriter and ArchiveExtractor interfaces first, then hide pear/archive_tar behind a thin implementation. The wrapper should translate boolean returns and errorInfo() strings into exceptions that Laravel's handler can report, and add type declarations so PHPStan/Larastan and IDEs can follow the code. Keep the wrapper small enough to swap implementations in an afternoon; a rough estimate is about a day of work.
- How should I test tar creation and extraction in Laravel?
- Test the wrapper, not the PEAR class directly. Use temporary directories and fixture archives, assert extracted file contents, and add explicit cases for path traversal attempts, symlink rejection, and extraction-root confinement. Also test failure paths where the package returns false and sets errorInfo(), because those must become exceptions. The package's own tests run with phpunit tests/ or pear run-tests -r, which is useful for validating the underlying library.
- Is pear/archive_tar still maintained and should I depend on it?
- It has a PEAR-era governance model, a low bus factor, and only about 75 GitHub stars, while its transitive reach gives it a very high blast radius. Future-dated releases such as 2025-07 and 2026-08 are a signal to verify tag dates, repackaging, or metadata rather than trust blindly. If it is already transitive via Composer, pin it at a safe version and stop thinking about it; if you are considering direct adoption, require a strong use case and keep an exit-friendly wrapper.
Weaver
How can I help you explore Laravel packages today?