Install Hyphae 3.0.0

Source: docs/release/receipts/3.0.0.md, “Primary release asset checksums” ↗.

Verify before you run it

Verbatim from the maintainer verification guide, replacing VERSION and TARGET with the values above.

1. Checksums. Download every file named in SHA256SUMS into the same directory, then:

sha256sum --check SHA256SUMS

Every listed archive and SBOM must report OK.

2. Keyless signature. Cosign 3.1.1 or later:

cosign verify-blob \
  --bundle hyphae-VERSION-TARGET.tar.gz.sigstore.json \
  --certificate-identity \
    'https://github.com/Hyphae-Research-Foundation/hyphae/.github/workflows/release.yml@RELEASE_WORKFLOW_REF' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  hyphae-VERSION-TARGET.tar.gz

Repeat for SHA256SUMS, both SBOMs, every provenance predicate, and the two report files.

3. Release-evidence binding. From a checkout of the exact source commit:

git checkout --detach COMMIT
git fetch --force --no-tags origin \
  '+refs/tags/vVERSION:refs/hyphae/verify-tag'
TAG_OBJECT="$(git rev-parse refs/hyphae/verify-tag)"
TAG_TARGET="$(git rev-parse 'refs/hyphae/verify-tag^{commit}')"
python packaging/release_evidence.py verify \
  --directory /path/to/downloaded-release \
  --manifest /path/to/downloaded-release/hyphae-vVERSION.release-evidence.json \
  --commit COMMIT \
  --tag-object "$TAG_OBJECT" \
  --tag-target "$TAG_TARGET"

4. Build provenance and SBOM attestations. SLSA provenance v1, keyed to the exact archive digest:

cosign verify-blob-attestation \
  --bundle hyphae-VERSION-TARGET.tar.gz.intoto.sigstore.json \
  --type slsaprovenance1 \
  --certificate-identity \
    'https://github.com/Hyphae-Research-Foundation/hyphae/.github/workflows/release.yml@refs/tags/vVERSION' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  hyphae-VERSION-TARGET.tar.gz

The archive also carries .spdx.attestation.sigstore.json and .cyclonedx.attestation.sigstore.json bundles — verify with the same identity and --type spdxjson or --type cyclonedx.

5. Inspect and smoke-test. Extract into an empty directory and confirm it contains one executable plus LICENSE, LICENSE-DOCUMENTATION, LICENSE-POLICY.md, NOTICE, README.md, and THIRD_PARTY_NOTICES.md:

tar -xzf hyphae-VERSION-TARGET.tar.gz
./hyphae-VERSION-TARGET/hyphae version --json

The reported product must be hyphae and engine_version must equal the tag without the leading v.

Source: docs/release/verification.md ↗.