Umbra Provider · macOS distribution

Review first. Then install in one command.

Umbra Provider turns an Apple Silicon Mac into an inference host. The disk image is signed with Apple's certificate forDeveloper ID Application: Tsz To Suen (3LHSL95J9H), notarized by Apple, and contains one app bundle. The installer verifies that identity and the published checksum before copying anything.

Install from Terminal Download signed DMG

Apple Silicon (M1 or newer) · macOS 14 or newer required · experimental alpha

01 · Publisher identity

Know what you are opening

ProductUmbra Provider

Bundle identifiercom.umbra.provider

Certificate publisherTsz To Suen

Developer ID Team3LHSL95J9H

Primary artifactumbra-macos-arm64.dmg

Gatekeeper statusNotarized Developer ID

Fail closed. If the checksum, Developer ID, nested app signatures, or Gatekeeper notarization check fails, do not bypass the warning or remove quarantine attributes. Delete the file and contact Umbra support.

02 · Installation

The fast, verified install path

This command downloads the DMG directly from tryumbra.dev, checks its SHA-256, Apple Developer ID Team, bundle identity, nested signatures, and Gatekeeper notarization, then installs the app and/usr/local/bin/umbra. On a first install it then starts guided setup in the same Terminal. Browser sign-in and the macOS profile approval remain explicit user actions. It requires macOS 14 or newer and stops without installing if any verification fails.

curl -fsSL https://tryumbra.dev/install.sh | sh

Read the complete installer before running it, or verify the current release without changing files:

curl -fsSL https://tryumbra.dev/install.sh | sh -s -- --dry-run

Prefer the manual DMG install?

1
Download the signed DMG above.
Nothing runs when the download completes.
2
Open it and move Umbra Provider.app to Applications.
Finder may ask for your Mac administrator approval to write to /Applications.
3
Start setup from Terminal.
This opens browser sign-in and then asks you to review the attestation enrollment separately.
```
"/Applications/Umbra Provider.app/Contents/MacOS/umbra" setup
```

Verify the DMG

cd ~/Downloads
DMG="$(ls -t umbra-macos-arm64-*.dmg | head -n1)"
EXPECTED="$(curl -fsSL "https://tryumbra.dev/dl/$DMG.sha256" | awk 'NR==1 {print $1}')"
ACTUAL="$(shasum -a 256 "$DMG" | awk '{print $1}')"
test "$EXPECTED" = "$ACTUAL"
codesign --verify --strict --verbose=2 "$DMG"
spctl -a -t open --context context:primary-signature "$DMG"

The checksum command compares the DMG with the separately published sidecar. The remaining commands ask macOS to validate the disk-image signature and stapled notarization ticket.

03 · System changes

Exactly what setup changes

Software and local files

/Applications/Umbra Provider.app from the verified installer or when you copy the app manually.
/usr/local/bin/umbra when you use the one-command installer; the manual DMG path does not add it.
An existing /opt/homebrew/bin/umbra is updated only when it is already a verified Umbra wrapper or legacy Umbra symlink. An unrelated executable is never replaced.
~/.umbra/ for account configuration, status-only logs, and GGUF models you choose to download.
~/Library/LaunchAgents/dev.tryumbra.host.plist only after you choose a model and start managed hosting.

Sign-in, models, and network

The one-command installer starts setup automatically on a first install when an interactive Terminal is available. Otherwise it prints the exact command to run.
Setup opens the Umbra browser sign-in; it does not collect a password in Terminal.
You select a public, platform-approved Hugging Face model and pull it with your own HF key.
Inference runs through linked llama.cpp inside the provider process, not a separate local inference server.
Prompts and outputs are memory-only and are never written to the local status logs.

Attestation enrollment

Setup downloads and opens the signed Umbra enrollment profile.
macOS requires you to review and approve it in System Settings, Device Management.
The profile is used for Managed Device Attestation. It does not grant remote lock, wipe, or general device-control permissions.
You can remove the profile yourself at any time; no script silently approves or removes it.

Running a provider is subject to the Provider Agreement, Terms, and Privacy Policy.

04 · Removal

Uninstall completely

The uninstaller prints its complete plan and asks for confirmation. By default it stops and removes the per-user LaunchAgent, Umbra Provider.app, all verified Umbra CLI wrappers (including an owned legacy Homebrew-path wrapper), and ~/.umbra including downloaded models. It leaves unrelated executables untouched. Pass --keep-data if you want to preserve local models and configuration.

curl -fsSLo /tmp/umbra-uninstall.sh https://tryumbra.dev/uninstall.sh
less /tmp/umbra-uninstall.sh
sh /tmp/umbra-uninstall.sh

The uninstaller deliberately leaves the Device Management profile in place. Review and remove it yourself in System Settings → General → Device Management → Umbra → Remove. macOS then performs the profile checkout and removes its managed attestation identity.

View the raw uninstall script before downloading or running it.