PHPackages humbug/box - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [CLI & Console](/categories/cli) 4. / 5. humbug/box ActiveLibrary[CLI & Console](/categories/cli) humbug/box ========== Fast, zero config application bundler with PHARs. 4.7.0(2mo ago)1.3k801.5k↑88.2%107[71 issues](https://github.com/box-project/box/issues)[9 PRs](https://github.com/box-project/box/pulls)20MITPHPPHP ^8.2CI failing Since Jul 18Pushed 1mo ago23 watchersCompare [ Source](https://github.com/box-project/box)[ Packagist](https://packagist.org/packages/humbug/box)[ RSS](/packages/humbug-box/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (10)Dependencies (60)Versions (185)Used By (20) [![Box logo](doc/img/box.png)](doc/img/box.png) [![Package version](https://camo.githubusercontent.com/9a304fd0f16d73466df8fddf726198061cbf180a0503b2ad72743168e809cf7e/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f68756d6275672f626f782e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/humbug/box)[![Scrutinizer Code Quality](https://camo.githubusercontent.com/cd8bbe6bdaeecf236d412833896bfb814fc53f21959b2809f6f9571c803d4f72/68747470733a2f2f696d672e736869656c64732e696f2f7363727574696e697a65722f672f68756d6275672f626f782e7376673f6272616e63683d6d6173746572267374796c653d666c61742d737175617265)](https://scrutinizer-ci.com/g/humbug/box/?branch=master)[![Slack](https://camo.githubusercontent.com/2f6358cd8cd3927356f9a75fc3b8fd8e83ce5bbad7f9efa4879e54f29780ebfb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f736c61636b2d25323368756d6275672d7265642e7376673f7374796c653d666c61742d737175617265)](https://symfony.com/slack-invite)[![License](https://camo.githubusercontent.com/10e85a5778fe7601504a17ecd18dfa7097f473186b0f947bc10db2d3e4f530e4/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d7265642e7376673f7374796c653d666c61742d737175617265)](LICENSE) Upgrading from [Box2](https://github.com/box-project/box2)? Checkout the [upgrade guide](UPGRADE.md#from-27-to-30)! Goal ---- [](#goal) The Box application simplifies the PHAR building process. Out of the box (no pun intended), the application can do many great things: - ⚡ Fast application bundling - 🔨 [PHAR isolation](doc/code-isolation.md#phar-code-isolation) - ⚙️ Zero configuration by default - 🚔 [Requirements checker](doc/requirement-checker.md#requirements-checker) - 🚨 Friendly error logging experience - 🔍 Retrieve information about the PHAR extension or a PHAR file and its contents (`box info` or `box diff`) - 🔐️ Verify the signature of an existing PHAR (`box verify`) - 📝 Use Git tags and short commit hashes for versioning - 🕵️️ Get recommendations and warnings about regarding your configuration (`box validate`) - 🐳 [Docker support (`box docker`)](doc/docker.md#docker-support) For the full documentation see . Table of Contents ----------------- [](#table-of-contents) 1. [Installation](doc/installation.md#installation) 1. [Phive](doc/installation.md#phive) 2. [Composer](doc/installation.md#composer) 3. [Homebrew](doc/installation.md#homebrew) 4. [GitHub](doc/installation.md#github) 5. [Docker](doc/installation.md#docker) 6. [shivammathur/setup-php (GitHub Actions)](doc/installation.md#shivammathursetup-php-github-actions) 2. [Usage](#usage) 3. [Configuration](doc/configuration.md#configuration) 1. [Base path (`base-path`)](doc/configuration.md#base-path-base-path) 2. [Main (`main`)](doc/configuration.md#main-main) 3. [Output (`output`)](doc/configuration.md#output-output) 4. [Permissions (`chmod`)](doc/configuration.md#permissions-chmod) 5. [Check requirements (`check-requirements`)](doc/configuration.md#check-requirements-check-requirements) 6. [Including files](doc/configuration.md#including-files) 1. [Force auto-discovery (`force-autodiscovery`)](doc/configuration.md#force-auto-discovery-force-autodiscovery) 2. [Files (`files` and `files-bin`)](doc/configuration.md#files-files-and-files-bin) 3. [Directories (`directories` and `directories-bin`)](doc/configuration.md#directories-directories-and-directories-bin) 4. [Finder (`finder` and `finder-bin`)](doc/configuration.md#finder-finder-and-finder-bin) 5. [Blacklist (`blacklist`)](doc/configuration.md#blacklist-blacklist) 6. [Excluding the Composer files (`exclude-composer-files`)](doc/configuration.md#excluding-the-composer-files-exclude-composer-files) 7. [Excluding dev files (`exclude-dev-files`)](doc/configuration.md#excluding-dev-files-exclude-dev-files) 8. [Map (`map`)](doc/configuration.md#map-map) 7. [Stub](doc/configuration.md#stub) 1. [Stub (`stub`)](doc/configuration.md#stub-stub) 2. [Alias (`alias`)](doc/configuration.md#alias-alias) 3. [Shebang (`shebang`)](doc/configuration.md#shebang-shebang) 4. [Banner (`banner`)](doc/configuration.md#banner-banner) 5. [Banner file (`banner-file`)](doc/configuration.md#banner-file-banner-file) 8. [Forcing the timestamp (`timestamp`)](doc/configuration.md#forcing-the-timestamp-timestamp) 9. [Dumping the Composer autoloader (`dump-autoload`)](doc/configuration.md#dumping-the-composer-autoloader-dump-autoload) 10. [Compactors (`compactors`)](doc/configuration.md#compactors-compactors) 1. [Annotations (`annotations`)](doc/configuration.md#annotations-annotations) 2. [PHP-Scoper (`php-scoper`)](doc/configuration.md#php-scoper-php-scoper) 11. [Compression algorithm (`compression`)](doc/configuration.md#compression-algorithm-compression) 12. [Security](doc/configuration.md#security) 1. [Signing algorithm (`algorithm`)](doc/configuration.md#signing-algorithm-algorithm) 2. [The private key (`key`)](doc/configuration.md#the-private-key-key) 3. [The private key password (`key-pass`)](doc/configuration.md#the-private-key-password-key-pass) 13. [Metadata (`metadata`)](doc/configuration.md#metadata-metadata) 14. [Replaceable placeholders](doc/configuration.md#replaceable-placeholders) 1. [Replacements (`replacements`)](doc/configuration.md#replacements-replacements) 2. [Replacement sigil (`replacement-sigil`)](doc/configuration.md#replacement-sigil-replacement-sigil) 3. [Datetime placeholder (`datetime`)](doc/configuration.md#datetime-placeholder-datetime) 4. [Datetime placeholder format (`datetime-format`)](doc/configuration.md#datetime-placeholder-format-datetime-format) 5. [Pretty git commit placeholder (`git`)](doc/configuration.md#pretty-git-tag-placeholder-git) 6. [Git commit placeholder (`git-commit`)](doc/configuration.md#git-commit-placeholder-git-commit) 7. [Short git commit placeholder (`git-commit-short`)](doc/configuration.md#short-git-commit-placeholder-git-commit-short) 8. [Git tag placeholder (`git-tag`)](doc/configuration.md#git-tag-placeholder-git-tag) 9. [Git version placeholder (`git-version`)](doc/configuration.md#git-version-placeholder-git-version) 4. [Requirements checker](doc/requirement-checker.md#requirements-checker) 1. [Configuration](doc/requirement-checker.md#configuration) 1. [PHP version requirements](doc/requirement-checker.md#php-version-requirements) 2. [Extension configuration requirements](doc/requirement-checker.md#extension-configuration-requirements) 3. [Polyfills](doc/requirement-checker.md#polyfills) 2. [Integration with a custom stub](doc/requirement-checker.md#integration-with-a-custom-stub) 5. [Optimize your PHAR](doc/optimizations.md#optimize-your-phar) 1. [Review your files](doc/optimizations.md#review-your-files) 2. [Compress your PHAR](doc/optimizations.md#compress-your-phar) 3. [Optimize your code](doc/optimizations.md#optimize-your-code) 6. [PHAR code isolation](doc/code-isolation.md#phar-code-isolation) 1. [Why/Explanation](doc/code-isolation.md#whyexplanation) 2. [Isolating the PHAR](doc/code-isolation.md#isolating-the-phar) 3. [Debugging the scoping](doc/code-isolation.md#debugging-the-scoping) 7. [Docker support](doc/docker.md#docker-support) 8. [Symfony support](doc/symfony.md#symfony-support) 1. [Project files](doc/symfony.md#project-files) 2. [Project directory](doc/symfony.md#project-directory) 3. [Cache](doc/symfony.md#cache) 9. [Reproducible builds](doc/reproducible-builds.md#reproducible-builds) 1. [Creating a reproducible PHAR](doc/reproducible-builds.md#creating-a-reproducible-phar) 1. [PHP-Scoper](doc/reproducible-builds.md#php-scoper) 2. [Composer](doc/reproducible-builds.md#composer) 1. [Composer root version](doc/reproducible-builds.md#composer-root-version) 2. [Composer autoload suffix](doc/reproducible-builds.md#composer-autoload-suffix) 3. [Box](doc/reproducible-builds.md#box) 1. [PHAR alias](doc/reproducible-builds.md#phar-alias) 2. [Requirement Checker](doc/reproducible-builds.md#requirement-checker) 3. [Box banner](doc/reproducible-builds.md#box-banner) 4. [Sort compiled files](doc/reproducible-builds.md#sort-compiled-files) 4. [PHAR](doc/reproducible-builds.md#phar) 2. [Usages](doc/reproducible-builds.md#usages) 10. [PHAR signing best practices](doc/phar-signing.md#phar-signing-best-practices) 1. [Built-in PHAR API](doc/phar-signing.md#built-in-phar-api) 1. [How to sign your PHAR](doc/phar-signing.md#how-to-sign-your-phar) 2. [How it works](doc/phar-signing.md#how-it-works) 3. [Why it is bad](doc/phar-signing.md#why-it-is-bad) 2. [How to (properly) sign your PHAR](doc/phar-signing.md#how-to-properly-sign-your-phar) 1. [Create a new GPG-key](doc/phar-signing.md#create-a-new-gpg-key) 2. [Manually signing](doc/phar-signing.md#manually-signing) 3. [Generate the encryption key](doc/phar-signing.md#generate-the-encryption-key) 4. [Secure your encryption key](doc/phar-signing.md#secure-your-encryption-key) 5. [Sign your PHAR](doc/phar-signing.md#sign-your-phar) 6. [Verifying the PHAR signature](doc/phar-signing.md#verifying-the-phar-signature) 3. [Automatically sign in GitHub Actions](doc/phar-signing.md#automatically-sign-in-github-actions) 11. [FAQ](doc/faq.md#faq) 1. [What is the canonical way to write a CLI entry file?](doc/faq.md#what-is-the-canonical-way-to-write-a-cli-entry-file) 1. [The shebang](doc/faq.md#the-shebang) 2. [The PHP\_SAPI check](doc/faq.md#the-php_sapi-check) 3. [Autoloading Composer](doc/faq.md#autoloading-composer) 2. [Detecting that you are inside a PHAR](doc/faq.md#detecting-that-you-are-inside-a-phar) 3. [Building a PHAR with Box as a dependency](doc/faq.md#building-a-phar-with-box-as-a-dependency) 12. [Contributing](#contributing) 13. [Upgrade guide](UPGRADE.md#upgrade-guide) 14. [Backward Compatibility Promise (BCP)](#backward-compatibility-promise-bcp) 15. [Credits](#credits) Usage ----- [](#usage) Creating a PHAR should be as simple as running `box compile` (**no config required!**). It will however assume some defaults that you might want to change. Box will by default be looking in order for the files `box.json` and `box.json.dist` in the current working directory. A basic configuration could be for example changing the PHAR permissions: ``` { "chmod": "0700" } ``` You can then find more advanced configuration settings in [the configuration documentation](doc/configuration.md#configuration). For more information on which command or options is available, you can run: ``` box help ``` Contributing ------------ [](#contributing) The project provides a `Makefile` in which the most common commands have been registered such as fixing the coding style or running the test. ``` make ``` Backward Compatibility Promise (BCP) ------------------------------------ [](#backward-compatibility-promise-bcp) The policy is for the major part following the same as [Symfony's one](https://symfony.com/doc/current/contributing/code/bc.html). Note that the code marked as `@private` or `@internal` are excluded from the BCP. The text displayed by the commands (e.g. `compile` or `info`) or the content of the error/exception messages are also not subject to the BCP. Credits ------- [](#credits) Project originally created by: [Kevin Herrera](https://github.com/kherge) ([@kherge](https://github.com/kherge)) which has now been moved under the [Humbug umbrella](https://github.com/humbug). ### Health Score 76 — ExcellentBetter than 100% of packages Maintenance88 Actively maintained with recent releases Popularity63 Solid adoption and visibility Community47 Growing community involvement Maturity95 Battle-tested with a long release history Bus Factor1 Top contributor holds 69.6% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~36 days Recently: every ~48 days Total 137 Last Release 62d ago Major Versions 1.0.9 → 2.0.0-alpha.12013-03-20 2.7.5 → 3.0.0-alpha.02018-03-05 3.16.0 → 4.0.02022-06-26 PHP version history (8 changes)1.0.0-alpha.1PHP >=5.3.3 3.0.0-alpha.0PHP ^7.1 3.7.1PHP ^7.2 3.10.0PHP ^7.3 3.11.0PHP ^7.3 || ^8.0 3.15.0PHP ^7.4 || ^8.0 4.0.0PHP ^8.1 4.6.0PHP ^8.2 ### Community Maintainers ![](https://www.gravatar.com/avatar/6fbf458a1f05f8ac5a3c8f6c5426abe81084b7077b24955747b09c35f6c983be?d=identicon)[theofidry](/maintainers/theofidry) --- Top Contributors [![theofidry](https://avatars.githubusercontent.com/u/5175937?v=4)](https://github.com/theofidry "theofidry (952 commits)")[![kherge](https://avatars.githubusercontent.com/u/9122157?v=4)](https://github.com/kherge "kherge (208 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (100 commits)")[![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)](https://github.com/github-actions[bot] "github-actions[bot] (26 commits)")[![villfa](https://avatars.githubusercontent.com/u/2891564?v=4)](https://github.com/villfa "villfa (19 commits)")[![jrfnl](https://avatars.githubusercontent.com/u/663378?v=4)](https://github.com/jrfnl "jrfnl (11 commits)")[![stof](https://avatars.githubusercontent.com/u/439401?v=4)](https://github.com/stof "stof (5 commits)")[![cordoval](https://avatars.githubusercontent.com/u/328359?v=4)](https://github.com/cordoval "cordoval (4 commits)")[![danepowell](https://avatars.githubusercontent.com/u/1984514?v=4)](https://github.com/danepowell "danepowell (4 commits)")[![sanmai](https://avatars.githubusercontent.com/u/139488?v=4)](https://github.com/sanmai "sanmai (4 commits)")[![smatyas](https://avatars.githubusercontent.com/u/534550?v=4)](https://github.com/smatyas "smatyas (3 commits)")[![johnstevenson](https://avatars.githubusercontent.com/u/881777?v=4)](https://github.com/johnstevenson "johnstevenson (3 commits)")[![owenvoke](https://avatars.githubusercontent.com/u/1899334?v=4)](https://github.com/owenvoke "owenvoke (3 commits)")[![empi89](https://avatars.githubusercontent.com/u/158283?v=4)](https://github.com/empi89 "empi89 (3 commits)")[![pborreli](https://avatars.githubusercontent.com/u/77759?v=4)](https://github.com/pborreli "pborreli (2 commits)")[![llaville](https://avatars.githubusercontent.com/u/364342?v=4)](https://github.com/llaville "llaville (2 commits)")[![mbrodala](https://avatars.githubusercontent.com/u/5037116?v=4)](https://github.com/mbrodala "mbrodala (2 commits)")[![keradus](https://avatars.githubusercontent.com/u/2716794?v=4)](https://github.com/keradus "keradus (2 commits)")[![cristianoc72](https://avatars.githubusercontent.com/u/865437?v=4)](https://github.com/cristianoc72 "cristianoc72 (2 commits)")[![timacdonald](https://avatars.githubusercontent.com/u/24803032?v=4)](https://github.com/timacdonald "timacdonald (2 commits)") --- Tags archivecommand-lineconsole-applicationpharphpphar ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/humbug-box/health.svg) ``` [![Health](https://phpackages.com/badges/humbug-box/health.svg)](https://phpackages.com/packages/humbug-box) ``` ### Alternatives [infection/infection Infection is a Mutation Testing framework for PHP. The mutation adequacy score can be used to measure the effectiveness of a test set in terms of its ability to detect faults. 2.2k26.2M1.8k](/packages/infection-infection)[humbug/php-scoper Prefixes all PHP namespaces in a file or directory. 7963.0M35](/packages/humbug-php-scoper)[sylius/sylius E-Commerce platform for PHP, based on Symfony framework. 8.4k5.6M651](/packages/sylius-sylius)[composer/composer Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. 29.4k187.2M2.6k](/packages/composer-composer)[drupal/core-recommended Locked core dependencies; require this project INSTEAD OF drupal/core. 6939.5M343](/packages/drupal-core-recommended)[drupal/core Drupal is an open source content management platform powering millions of websites and applications. 19562.3M1.3k](/packages/drupal-core) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)