Install

Every version tag is built on the matching native GitHub-hosted runner.

Homebrew (macOS)

Homebrew automatically selects the Apple Silicon or Intel build:

brew install --cask ochub-team/tap/ochub

Upgrade or uninstall OcHub with:

brew upgrade --cask ochub-team/tap/ochub
brew uninstall --cask ochub

The Cask is maintained in the OcHub-team/homebrew-tap repository and downloads the same DMG published with each GitHub Release.

Direct downloads

The release also includes SHA256SUMS and a GitHub artifact attestation. Verify a downloaded file with:

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify <downloaded-file> --repo OcHub-team/OcHub

Headless CLI for remote nodes

Every release also provides headless archives for macOS, Windows, and Linux. Each archive contains one executable, ochcli. It is the command-line control surface, Remote Nodes protocol server, and persistent runtime owner.

On Linux or WSL:

tar -xzf OcHub_*_linux_x86_64_cli.tar.gz
chmod +x ochcli
./ochcli node install
ochcli version
ochcli node status
ochcli remote probe

The managed installer retains versions under the user profile, exposes ~/.local/bin/ochcli, and installs a user service when the platform provides one. It also enables atomic one-click update and rollback of the CLI and its background owner as one unit.

The desktop starts ochcli remote serve --stdio through system OpenSSH when it connects; do not expose that protocol with a network listener. Continue with Control remote nodes over SSH for SSH, WSL, host-key, provider-import, switching, and one-click update instructions.

macOS: approving the app on first launch

OcHub is signed with an Apple Developer ID, but notarization is not enabled yet, so macOS asks you to approve OcHub once on first launch. This is expected for OcHub and does not mean the download is broken.

Control-clicking the app no longer works for this on macOS 15 and later — the System Settings route is the only one. It is a one-time step: updates installed from inside OcHub do not ask again.

Windows SmartScreen may warn for the same reason.

Updating

OcHub checks for a new release shortly after launch and once a day after that, and can install one from Settings → About → Check for updates without leaving the app. Turn the check off with the toggle in the same group.

Downloaded packages are verified against a signing key compiled into the binary, and a version that is not newer than the running one is refused, so the update channel cannot be used to push unsigned code or to roll an install backwards.

Two install methods stay check-only, because self-updating them would fight the system that owns them:

Those two report the reason in the settings row and link to the release page.