Install and verify

The Cube is one program, cube, plus two tool programs that it runs from its own folder: cube-index (the index) and cube-graph (the knowledge graph). The installer puts all three on your machine for your own account. What your machine needs is on requirements.

Install

Until https://cube.happonomy.org is live, the site and the installers are on GitHub Pages at the address below. After the move, GitHub forwards this address to the new one, so these commands keep working.

Linux and macOS:

curl -fsSL https://happonomyorg.github.io/cube-releases/install.sh | sh

Windows (PowerShell 5.1 or 7):

irm https://happonomyorg.github.io/cube-releases/install.ps1 | iex

The programs are not code-signed. Installed this way they are not marked as downloaded from the internet, so SmartScreen does not stop them. If Windows Smart App Control is on, though, Windows does not run them at all; see requirements.

Where it installs

The installer installs for your own account only. Do not run it with sudo: it refuses to run through sudo.

System	Folder
Linux and macOS	~/.local/bin
Windows	%LOCALAPPDATA%\Programs\cube, added to your user PATH

Set these environment variables before you run the installer to change what it does:

Variable	What it does
CUBE_INSTALL_DIR	Another folder for the programs (an absolute path).
CUBE_CHANNEL	The channel: alpha, the default. beta and stable come later.
CUBE_INSTALL_SKIP_GITHUB_CHECK=1	Skip the check against GitHub’s record (see below). Use it only when GitHub’s API cannot be reached.

To update, run the installer again.

Platforms

System	Builds
Linux	x86_64 and arm64
macOS	Apple silicon (arm64) and Intel (x86_64)
Windows	x86_64

On macOS and Windows, the git hooks refuse and cube check skips the kit’s own checks with a warning, until a later release adds those systems’ ownership checks. Linux has everything. See the known limits.

What the installer checks

The installer installs nothing unless every check passes:

1. The signature. The channel manifest, https://happonomyorg.github.io/cube-releases/alpha.json, names the newest version and the SHA-256 of every download. If the minisign program is installed, the manifest’s signature (alpha.json.minisig) must match one of Happonomy’s two public keys. Without minisign, this check is skipped, and the installer says so.
2. GitHub’s record. GitHub’s API must mark the release immutable (its files can never change), and GitHub’s SHA-256 digest of the download must equal the manifest’s. This is a second source, independent of this site.
3. The download. The SHA-256 of the downloaded archive must equal the manifest’s.

The installer also refuses a manifest that has expired, and a cube that does not report the manifest’s version. Each manifest is valid for 90 days, and it is signed again every month. On any failure, the installer stops with an error, removes what it downloaded and leaves no new program.

These checks stop a swapped archive or manifest: someone who changes the files on this site cannot make the installer accept a different program, as long as GitHub’s check runs. They cannot protect you from a changed install script, because the script is what runs the checks.

Check the script first

Each release also carries both install scripts as release assets on GitHub, where they cannot change after publication, and GitHub records the SHA-256 of each. To check a script before you run it, download it, compare it with that record or read it, then run the saved copy. With the GitHub CLI, gh release verify-asset does the comparison (use the newest release, for example cube-v0.1.0); without it, compare the output of sha256sum with the digest GitHub shows for the asset on the release page.

curl -fsSL https://happonomyorg.github.io/cube-releases/install.sh -o install.sh
gh release verify-asset cube-v0.1.0 install.sh --repo HapponomyOrg/cube-releases
# or: sha256sum install.sh, and compare with the release page
# read install.sh, then run the saved copy:
sh install.sh

When GitHub’s API cannot be reached

GitHub allows 60 anonymous API calls an hour from one address. If the API cannot be reached (you are offline, behind a proxy, or over that limit), the installer stops and names the opt-out. To install anyway, set CUBE_INSTALL_SKIP_GITHUB_CHECK=1. The installer then warns that GitHub’s record is not checked: only this site’s manifest vouches for the file.

Repeat the checks by hand

Replace the target with yours: x86_64-unknown-linux-musl, aarch64-unknown-linux-musl, x86_64-apple-darwin, aarch64-apple-darwin or x86_64-pc-windows-msvc.

1. Download the manifest and its signature:

   curl -fsSLO https://happonomyorg.github.io/cube-releases/alpha.json
   curl -fsSLO https://happonomyorg.github.io/cube-releases/alpha.json.minisig

2. Check the signature. Either public key must pass:

   minisign -V -m alpha.json -P <public key>

3. Find your target’s line in the manifest, download its url, and compare the file’s SHA-256 with the line’s sha256:

   grep '"x86_64-unknown-linux-musl"' alpha.json
   curl -fsSLO <the url from that line>
   sha256sum <the archive>        # macOS: shasum -a 256 <the archive>

   On Windows, Get-FileHash -Algorithm SHA256 <the archive> gives the SHA-256.

4. Compare both with GitHub’s record of the release (the tag is in alpha.json). With the GitHub CLI:

   gh release verify-asset <tag> <the archive> -R HapponomyOrg/cube-releases

   Or read the release in GitHub’s API: "immutable" must be true, and the asset’s "digest" must be sha256: followed by the same SHA-256.

   curl -fsSL https://api.github.com/repos/HapponomyOrg/cube-releases/releases/tags/<tag>

What a download holds

Each program archive holds cube, cube-index and cube-graph (.exe on Windows), LICENSE, THIRD-PARTY-NOTICES.md and README.md. Each file of a release has a .sha256 file beside it on the releases page.

Next: the quick start. To remove The Cube again, see uninstall.