Vaglio v0.2.0

The archives

Beside them in the release: SHA256SUMS, and two software bills of materials in the CycloneDX format, one for the program and one for its console.

Install it as a service, in one command

On Linux (systemd) or macOS (launchd), as root:

curl -fsSL https://raw.githubusercontent.com/BioDream-LLC/vaglio/main/deploy/install.sh | sudo sh -s -- -version v0.2.0

On Windows, from an elevated PowerShell:

& ([scriptblock]::Create((irm https://raw.githubusercontent.com/BioDream-LLC/vaglio/main/deploy/install.ps1))) -Version v0.2.0

The installer downloads the archive for your machine and refuses it unless its fingerprint (SHA-256) matches the one the release lists. When the GitHub command-line tool is installed, it also checks GitHub's record of which build made the archive. It then runs Vaglio as an unprivileged account, keeps its data in a folder only that account can read, and makes a random access token for the PAS server in front of it. Running it again with a newer version upgrades it and keeps the data and policies.

A container image (distroless, non-root) and a Helm chart for Kubernetes are in the repository, under Dockerfile and deploy/helm/vaglio.

The first start

The first start creates an admin account and prints its password once. Vaglio answers on HTTPS only. By default it uses a certificate authority of its own, made for this server alone, whose certificate you trust once; it can also use the plan's own certificate, or get one from Let's Encrypt by itself.

From version 0.2.0 the built-in library's policies decide nothing until the plan's clinicians adopt them in the console. For a quick trial, start the server with -require-adoption=false and they decide as published. Why it works this way.

Check what you downloaded

You do not have to take our word for what is in an archive.

• Its fingerprint. shasum -a 256 -c SHA256SUMS --ignore-missing checks each archive you downloaded against the list.
• Who built it. Each archive carries a signed statement from GitHub Actions saying which commit and which workflow built it: gh attestation verify vaglio-v0.2.0-linux-amd64.tar.gz --repo BioDream-LLC/vaglio.
• That the source makes it. The archives are reproducible. The release workflow builds them twice, on x86 and on Arm, and publishes nothing unless both builds are the same, byte for byte. Running deploy/release.sh v0.2.0 from the tagged commit gives the same bytes on your machine.

Build it from source

It needs Go 1.27, and Node 20 only if you want to rebuild the console (the built console is in the repository, so Go alone is enough).

git clone https://github.com/BioDream-LLC/vaglio && cd vaglio
make check      # formatting, vet, every test with the race detector, the console's tests
make build      # bin/vaglio: one static program

The licence

Vaglio is source-available under the PolyForm Shield License 1.0.0. Anyone may use it, change it and share it, a health plan deciding its own prior authorization requests included. What it does not allow is using Vaglio to offer a product that competes with Vaglio, or with a product BioDream LLC offers using it. For anything else, ask BioDream LLC for a commercial licence.

The source is published so that anyone can read how a decision is made. Outside contributions are not accepted, so pull requests are not reviewed or merged; bug reports and private security reports are welcome.

What this release is not

It is not certified by anyone, not penetration tested by an outside firm, and not validated clinically in production. Everything it has not done yet, said plainly.