Installation and security

Users install Kyna from a release without cloning or building the repository. The shell and PowerShell installers select the exact operating-system and CPU archive, download it over HTTPS, verify its SHA-256 entry, and replace the per-user executable only after verification succeeds.

One-command installation

Unix and macOS:

1curl -fsSL https://github.com/Up-to-code/Kyna/releases/latest/download/install.sh | sh

Windows PowerShell:

1irm https://github.com/Up-to-code/Kyna/releases/latest/download/install.ps1 | iex

npm, when Node.js is already installed:

1npm i -g @kyna-language/cli@preview

The npm installer is version-locked to the corresponding GitHub tag and verifies the same native archive against SHA256SUMS. It does not contain or compile a separate implementation of the language.

Use npm i -g @kyna-language/cli@latest for an explicit stable installation, npm i -g @kyna-language/cli@preview for the latest prerelease, npm i -g @kyna-language/cli@<version> to pin a release, and npm update -g @kyna-language/cli to update an existing global installation. npm distribution tags select a published package version; the package then downloads only the matching GitHub tag.

Piping a remote script executes code from the network. A more inspectable installation downloads the script first, reviews it, and then runs it:

1curl -fLO https://github.com/Up-to-code/Kyna/releases/latest/download/install.sh
2less install.sh
3sh install.sh

Use --prefix, --version, --channel stable|preview, and non-interactive mode as documented by install.sh --help or install.ps1 -Help. Preview installation requires an explicit version and never silently follows the stable latest URL.

Release trust chain

Stable release policy requires all of the following:

• clean Linux, Windows, and macOS hosted-runner builds;
• SHA-256 entries for every archive and installer;
• GitHub build-provenance attestations for native archives;
• Developer ID signing and Apple notarization for macOS binaries;
• Authenticode signing with a trusted timestamp for Windows binaries;
• a release workflow failure when stable signing credentials are absent.

Tags containing a prerelease suffix are published as prereleases. They may be unsigned and therefore require an explicit version instead of the stable installer route. A workflow definition expresses policy; users should still inspect the actual release assets and attestations for the version they install.

Verify a downloaded archive

Download SHA256SUMS and the archive from the Kyna release page. From the directory containing both files:

1sha256sum --check SHA256SUMS --ignore-missing       # Linux
2shasum -a 256 -c SHA256SUMS                         # macOS

On Windows PowerShell:

1Get-FileHash .\kyna-windows-x86_64.zip -Algorithm SHA256

Compare the digest with the archive's exact SHA256SUMS entry before execution. SHA-256 detects corruption or substitution relative to that checksum file; provenance attestations and platform signatures provide the stronger link to the release workflow and publisher identity.

Update, rollback, and removal

ky self update invokes the same verified installer contract. Before replacing an existing executable, the installers retain a .previous copy under the selected prefix. Installation is scoped to ~/.local by default on Unix and %LOCALAPPDATA%\Kyna on Windows; a custom prefix stays explicit.

ky self uninstall removes only files recorded under the resolved Kyna prefix. It does not remove projects or arbitrary user files.

Platform warnings

A correctly published stable macOS binary is signed and notarized. A Gatekeeper warning on a stable asset should be investigated: confirm the release source, checksum, signature, notarization result, and provenance instead of bypassing the warning. Explicit prerelease builds may lack platform signing and can trigger security warnings.

Apple documents opening software safely and Gatekeeper runtime protection.

Runtime capabilities

The CLI accesses the filesystem, process environment, clock, network, and database through injected host capabilities. The compiler core does not own those effects. Network examples use public keyless services and contain no credentials.

Treat Kyna scripts as executable programs: review third-party source, constrain module and filesystem paths, avoid exposing secrets through process environments, and use deterministic host adapters in integration tests. Checksums and code signing protect distribution; they do not make an untrusted Kyna program safe.