Skip to content

v0.5.0

Choose a tag to compare

View all tags
@SnakePlushkin SnakePlushkin released this 30 Mar 21:45
· 29 commits to main since this release
v0.5.0
19a1433

What's New

License Scanning & SBOM Support

  • New phalus scan command to audit dependency licenses before reimplementing
  • Reads manifests (package.json, requirements.txt, Cargo.toml, go.mod) and SBOMs (CycloneDX JSON, SPDX JSON)
  • Resolves license metadata from registries, normalizes to SPDX identifiers
  • Classifies licenses into risk buckets: permissive, copyleft-weak, copyleft-strong, proprietary, unknown
  • REST API endpoints: POST /api/scans, GET /api/scans, GET /api/scans/{id}, GET /api/licenses

Multi-Provider LLM Support

  • OpenAI-compatible API support: use OpenAI, OpenRouter, Ollama, vLLM, LiteLLM, or any compatible endpoint
  • Each agent can use a different provider and model independently
  • Set agent_a_provider / agent_b_provider to any value other than "anthropic" for OpenAI wire protocol

Security Hardening

  • Cache path traversal prevention: sanitize package names in cache filenames
  • Atomic cache writes (write-then-rename) to prevent partial reads
  • Container firewall: direct process execution instead of shell invocation to prevent injection
  • UUID-based temp filenames in firewall crossing

Documentation

  • Full scan command reference in CLI docs
  • OpenAI-compatible provider setup guide with examples for OpenAI, OpenRouter, Ollama, vLLM, mixed providers
  • Scan API endpoints documented in API reference
  • Security hardening details in security docs

Install

cargo install phalus

Or download a pre-built binary below.

Verification

Each binary is signed with Sigstore cosign. Verify with:

cosign verify-blob --certificate phalus-*.pem --signature phalus-*.sig phalus-*.tar.gz \
  --certificate-identity-regexp="https://github.com/phalus-sh/phalus" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

SHA256 checksums are in checksums.txt (also signed).

Assets 17
Loading