Umbra Provider · macOS distribution

Review first. Then download the signed app.

Umbra Provider turns an Apple Silicon Mac into an inference host. The disk image is signed with Apple's certificate forDeveloper ID Application: Tsz To Suen (3LHSL95J9H), notarized by Apple, and contains one app bundle. The DMG does not install anything automatically.

Download signed DMG Published SHA-256

Apple Silicon (M1 or newer) · macOS 14 or newer required · experimental alpha

01 · Publisher identity

Know what you are opening

ProductUmbra Provider

Bundle identifiercom.umbra.provider

Certificate publisherTsz To Suen

Developer ID Team3LHSL95J9H

Primary artifactumbra-macos-arm64.dmg

Gatekeeper statusNotarized Developer ID

Fail closed. If the checksum, Developer ID, nested app signatures, or Gatekeeper notarization check fails, do not bypass the warning or remove quarantine attributes. Delete the file and contact Umbra support.

02 · Manual install

The primary install path

1
Download the DMG above.
Nothing runs when the download completes.
2
Open it and move Umbra Provider.app to Applications.
Finder may ask for your Mac administrator approval to write to /Applications.
3
Start setup from Terminal.
This opens browser sign-in and then asks you to review the attestation enrollment separately.
```
"/Applications/Umbra Provider.app/Contents/MacOS/umbra" setup
```

Verify the checksum, signature, and notarization yourself

cd ~/Downloads
curl -fsSLO https://tryumbra.dev/dl/umbra-macos-arm64.dmg.sha256
shasum -a 256 -c umbra-macos-arm64.dmg.sha256
codesign --verify --strict --verbose=2 umbra-macos-arm64.dmg
spctl -a -t open --context context:primary-signature umbra-macos-arm64.dmg

The checksum command compares the DMG with the separately published sidecar. The remaining commands ask macOS to validate the disk-image signature and stapled notarization ticket.

03 · System changes

Exactly what setup changes

Software and local files

/Applications/Umbra Provider.app when you copy the app.
~/.umbra/ for account configuration, status-only logs, and GGUF models you choose to download.
~/Library/LaunchAgents/dev.tryumbra.host.plist only after you choose a model and start managed hosting.
The manual DMG path does not add a command to /usr/local/bin.

Sign-in, models, and network

Setup opens the Umbra browser sign-in; it does not collect a password in Terminal.
You select a public, platform-approved Hugging Face model and pull it with your own HF key.
Inference runs through linked llama.cpp inside the provider process, not a separate local inference server.
Prompts and outputs are memory-only and are never written to the local status logs.

Attestation enrollment

Setup downloads and opens the signed Umbra enrollment profile.
macOS requires you to review and approve it in System Settings, Device Management.
The profile is used for Managed Device Attestation. It does not grant remote lock, wipe, or general device-control permissions.
You can remove the profile yourself at any time; no script silently approves or removes it.

Running a provider is subject to the Provider Agreement, Terms, and Privacy Policy.

04 · Removal

Uninstall completely

The uninstaller prints its complete plan and asks for confirmation. By default it stops and removes the per-user LaunchAgent, Umbra Provider.app, the official CLI wrapper, and ~/.umbra including downloaded models. Pass --keep-data if you want to preserve local models and configuration.

curl -fsSLo /tmp/umbra-uninstall.sh https://tryumbra.dev/uninstall.sh
less /tmp/umbra-uninstall.sh
sh /tmp/umbra-uninstall.sh

The uninstaller deliberately leaves the Device Management profile in place. Review and remove it yourself in System Settings → General → Device Management → Umbra → Remove. macOS then performs the profile checkout and removes its managed attestation identity.

View the raw uninstall script before downloading or running it.