scp, sftp, and rsync Transfer Workflows

1. Choose the transfer tool by workflow

2. scp is simple for one-shot copies

scp \
  -o BatchMode=yes \
  -o ConnectTimeout=5 \
  ./artifact.tar.gz \
  ops@example-host:/srv/releases/

Use the same SSH trust and identity controls you would use with ssh.

3. Remote-path syntax creates another parsing boundary

scp './release candidate.tar.gz' \
  'ops@example-host:/srv/releases/release candidate.tar.gz'

Spaces and metacharacters in remote paths increase quoting complexity. Prefer simple deployment path conventions when you control the remote layout.

4. sftp batch mode makes operations explicit

cat > commands.sftp <<'EOF'
put artifact.tar.gz /srv/releases/artifact.tar.gz
ls -l /srv/releases
EOF

sftp \
  -b commands.sftp \
  -o BatchMode=yes \
  ops@example-host

Batch files are useful when a transfer includes several protocol-level operations.

5. rsync is optimized for synchronization

rsync -a \
  --delete-delay \
  --exclude '.git/' \
  ./site/ \
  ops@example-host:/srv/site/

6. rsync dry-run is a first-class safety tool

rsync -anv \
  --delete \
  ./site/ \
  ops@example-host:/srv/site/

Review which files would be created, updated, or deleted before the real operation.

7. Trailing slash semantics matter in rsync

# Copy contents of site into /srv/site:
rsync -a ./site/ host:/srv/site/

# Copy directory site itself into destination:
rsync -a ./site host:/srv/

This small syntax difference changes the resulting directory tree and should be covered by tests or deployment documentation.

8. Partial transfer behavior should be intentional

Large files may benefit from resumable or partial-transfer options, but partially transferred content should not become visible under a final production filename until validation is complete.

9. Transfer success is not content validation

sha256sum artifact.tar.gz > artifact.sha256

scp artifact.tar.gz artifact.sha256 \
  ops@example-host:/srv/staging/

ssh ops@example-host \
  'cd /srv/staging && sha256sum -c artifact.sha256'

End-to-end verification catches corruption and wrong-content mistakes that transport success alone cannot detect.

10. Transfer to staging, then promote

scp artifact.tar.gz host:/srv/staging/artifact.tar.gz

ssh host '
  verify_artifact /srv/staging/artifact.tar.gz &&
  mv /srv/staging/artifact.tar.gz /srv/releases/artifact.tar.gz
'

Remote staging prevents consumers from seeing an incomplete or unverified artifact.

11. Hands-on lab: design an rsync deployment command

mkdir -p "$HOME/devops-academy/bash/chapter14/lesson03/site"
cd "$HOME/devops-academy/bash/chapter14/lesson03"

printf '<h1>hello</h1>\n' > site/index.html
printf 'version=1\n' > site/version.txt

cat > deploy-preview.sh <<'EOF'
#!/usr/bin/env bash
set -u

host=${1:-}
dest=${2:-/tmp/site-preview}

[[ -n $host ]] || {
  printf 'usage: %s HOST [DEST]\n' "$0" >&2
  exit 64
}

rsync \
  -anv \
  --delete \
  --exclude '.git/' \
  -e 'ssh -o BatchMode=yes -o ConnectTimeout=5' \
  ./site/ \
  "$host:$dest/"
EOF

chmod u+x deploy-preview.sh
printf 'Run with a reachable SSH host to preview synchronization.\n'

12. Knowledge check

13. Summary

Use scp for straightforward copies, sftp for protocol-level file operations, and rsync for repeated synchronization. Make remote-path semantics explicit, preview destructive changes, verify content, and promote from staging only after validation.

14. Further reading

• OpenSSH scp(1) and sftp(1) manuals.
• rsync documentation — archive, delete, dry-run, trailing slashes.
• OpenSSH security and host-key documentation.
• GNU Coreutils checksum utilities.