- Is sf2h/sftp-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle built around a thin wrapper over PHP's SFTP functions via phpseclib, and its value is split between that client logic and Symfony-specific plumbing such as DependencyInjection extensions and services configuration files. Nothing in it targets Laravel's service container, facades, or filesystem abstraction, so it does not register as a Laravel package. Treat it as a reference implementation rather than a dependency in a Laravel codebase.
- How do I install sf2h/sftp-bundle with Composer?
- Install it the Symfony way with composer require sf2h/sftp-bundle, then register the bundle in config/bundles.php and add your connection settings under config/packages. Because the last tagged release was 2020-12-22, check which version Composer resolves and whether that constraint suits your PHP runtime before committing. Confirm that ext-openssl and ext-mbstring are enabled in every environment, since phpseclib requires them.
- Can I use sf2h/sftp-bundle in a Laravel application?
- You can, but it is not recommended. The reusable part is a few hundred lines of phpseclib invocation code; the Symfony DI extension, service definitions, and bundle registration mean nothing inside Laravel. Extracting that client into a service provider takes a few hours, and you would then own untested, unmaintained code. Use league/flysystem-sftp-v3 behind the Storage facade instead.
- What is the best Laravel alternative to sf2h/sftp-bundle for SFTP transfers?
- league/flysystem-sftp-v3, exposed through a Laravel Storage disk such as Storage::disk('sftp_partner'), is the ecosystem standard. It is actively maintained, implements Laravel's filesystem contract, gives you put, get, exists, and files for free, and lets you swap the transport for a local or S3 disk in tests. That covers everything the bundle advertises plus the maintenance and security-response path the bundle lacks.
- Which phpseclib version does sf2h/sftp-bundle require, and does it run on PHP 8.2 and 8.3?
- The bundle predates widespread phpseclib 3 adoption, and its composer.json constraint decides whether you inherit phpseclib 2.x debt such as namespace changes and PHP 8 deprecation notices. Its last release was 2020-12-22, so it was never validated against PHP 8.2 or 8.3. Run a spike with E_ALL error reporting on your target runtime before assuming it is clean. If you need a modern phpseclib, go straight to Flysystem.
- Does sf2h/sftp-bundle verify SSH host keys?
- There is no visible evidence of host-key or fingerprint verification in the bundle's advertised surface, which is limited to connect, list, get, and put. Without fingerprint pinning per endpoint, every transfer is exposed to man-in-the-middle attacks, which is disqualifying for partner integrations carrying PII or payment data. Read the source and confirm you can pin known_hosts entries before any production use.
- Does sf2h/sftp-bundle support key-based auth, passphrases, non-standard ports and timeouts?
- Configuration lives in Symfony's package config and services files, where you define host, port, username, and either a password or a private key path. Check the source to confirm whether passphrase-protected keys, non-standard ports, chrooted paths, and configurable timeouts or keep-alives are actually exposed. Anything the bundle does not support has to be built on top, so budget for it. In Laravel the equivalent is a config-driven disk entry in filesystems.php.
- Is sf2h/sftp-bundle still maintained and safe for production?
- It is effectively unmaintained: last release 2020-12-22, roughly 3 stars, 0 dependents, and no visible CI or test suite. That means no community pressure to fix bugs, no security-response path, and nobody watching CVEs in its transitive dependencies. For anything touching production file transfers, that sustainability risk usually outweighs the few hours the bundle saves. A fork quickly becomes your own test suite.
- How do I test SFTP uploads and downloads without hitting a real server?
- Abstract transfers behind a small gateway interface with push, pull, list, and exists methods so application code never imports phpseclib or Flysystem directly. In tests, bind that interface to a fake backed by a local or in-memory Flysystem adapter, and keep one real integration test against a containerized SFTP server. If you adopt the bundle directly, assume you are also adopting the job of writing its missing tests.
- How do I migrate from sf2h/sftp-bundle to Laravel's Storage facade?
- Start with a one-to-two day spike that connects to one real endpoint from a Laravel command on your PHP version with host-key pinning enabled, which either kills the option cheaply or confirms it. Then define an SftpGateway interface, implement it on league/flysystem-sftp-v3, and add config-driven disk definitions per partner. If anything from the bundle survives the spike, port it privately behind the same interface with the license header retained and delete the rest.