install

Additional install commands

macOS

Homebrewverified · 100%

brew install phive

local Homebrew formula metadata

overview

Package summary

Phar Installation and Verification Environment (PHIVE)

Project links

Commands and aliases

phive

history

Project history and usage

PHIVE—the Phar Installation and Verification Environment—is a package manager for installing and cryptographically verifying command-line PHP applications distributed as PHAR archives.

Project history

PHIVE was created by the phar.io project to automate the repetitive process of locating, selecting, downloading, verifying, and making PHP PHAR applications executable. Its design deliberately separates project tooling from the source-library dependency graph managed by Composer.

Adoption history

PHIVE is available through Homebrew and can also be installed as a verified PHAR. PHP projects use it to manage development executables such as PHPUnit, PHPStan, Psalm, phpDox, and PHP_CodeSniffer independently of application dependencies.

How it is used

Projects use `phive install` to add a tool, `phive update` to refresh managed tools, and manifest files to reproduce the tool set. Archives are cached under `~/.phive` and are normally symlinked into project-selected locations unless copy mode is requested.

Why package nerds care

PHIVE treats executable PHAR tools as a distinct package class. It verifies archive hashes and OpenPGP or OpenSSL signatures, caches archives in a shared user directory, and normally links them into each project, avoiding repeated downloads and Composer dependency conflicts.

Timeline

2015 era: PHIVE's copyright and early release history identify the beginning of the project.
Subsequent development: PHIVE added a repository-backed tool-discovery model, shared archive caching, project manifests, updates, and offline-preference workflows.
Homebrew adoption: The official README documents PHIVE installation through Homebrew alongside verified PHAR installation.

Related projects

Composer is the principal alternative discussed by PHIVE: it can install PHP tools, but PHIVE avoids mixing tool dependencies with application dependencies.
PHIVE's own project manifest demonstrates management of PHPUnit, PHPStan, Psalm, php-cs-fixer, phpab, and Composer as PHAR tools.

Sources

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

narrow executable package without higher-risk signals

Signals

metadata:no-higher-risk-signals

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 1 platform targets.
Installs with 1 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: ./phive.xml./.phive/phars.xml

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix: auth.xml

executables

Installed executables

Command	Kind	Exposure	Note
`phive`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-11-04

manager version0.16.0

manager updated2026-10-06

local dataok

upstreamnot checked

latest detectednot detected

https://github.com/phar-io/phive

infoNo cached GitHub release or tag data was available.https://github.com/phar-io/phivenone confidence

install metadata

Package metadata

Package key	brew:phive
Version	0.16.0
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/phive
Homepage	https://phar.io
Repository	https://github.com/phar-io/phive
Upstream docs	https://phar.io
License	BSD-3-Clause
Source archive	https://github.com/phar-io/phive/releases/download/0.16.0/phive-0.16.0.phar
Last updated	2026-10-06T14:42:32+03:00
Pulse	updated
Dependencies	php
Bottle	available (on all)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	phive
Version Scheme	0
Revision	0
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	stable

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/phive.yml

Used sources

Geiger risk classifier
cross-ecosystem install command graph
curated configuration and credential file locations
curated package history
package relationship graph
package version freshness
package-page enrichment
pkg.so package database
pkgdb category and tag curation

Install phive with Homebrew