8. How it works inside
8.4 Where the tools come from
The official sources of each component, the cryptographic checks, downloading by hand and the full table of sources.
In the app: «Tools»
In short
- Every component comes from its maker's official source, over HTTPS: no mirrors, no third-party copies.
- Every file is verified with its cryptographic hash before it is used; if it does not match, it is discarded.
- If a download fails, you can download the file with the browser and hand it to the kit, which verifies it the same way.
The path of a download
- RequestWhich is the latest version and what its hash is, from the official source.
- DownloadInto a .part file in the work folder; three attempts.
- CheckComputes the file's hash and compares it with the expected one.
- Extractzip, tar.gz, tar.xz, 7z or single file.
- ReplacePuts the new folder in place of the old one, all at once.
- TestRuns the program to check that it responds.
| Check | What it means | Examples |
|---|---|---|
| SHA-256, SHA-512, SHA3-256 | The file's hash must be the one published by the maker (or pinned in the kit's catalog). | Python, Node.js, Go, Maven, Caddy, SQLite, the editor, Pi, llama.cpp, the local models |
| npm sha512 | The integrity hash of the npm registry. | Claude Code, Codex |
| Authenticode (Windows only) | In addition, the maker's digital signature on the program, with the revocation check. | Claude Code, Visual C++ runtime |
When a download fails: “manually”
If the download fails after three attempts (a blocking proxy, an unreachable site), a panel appears under the component's row:
- Click “Download it in the browser: <file name>”: the exact address opens in the browser.
- When the file has downloaded, drag it onto the panel or use “browse…”.
- The kit keeps it and uses it only if its hash is the published one; the installation restarts by itself (“Added …: trying again.”).
The panel appears only when the file's hash is known. Files handed over and not used are deleted after 30 days.
GitHub and the API limits
Many components are published on GitHub. Without a sign-in, the GitHub API allows 60 requests an hour; with the kit's account (The kit's GitHub account (6.1)) or with a GITHUB_TOKEN variable on the PC, 5,000. The kit keeps the responses and, if the limit is reached, reads the latest version straight from the GitHub pages.
Other services the app contacts
| Service | Why |
|---|---|
api.github.com/repos/nabre/atollo/releases | Atollo's updates. |
open-vsx.org | The editor's extensions. |
api.anthropic.com · chatgpt.com · cloudcode-pa.googleapis.com | The limits of the agents' plans, with the saved sign-in, read-only and only with the AI page open. |
huggingface.co | The local models: the search for GGUF files and the downloads, which huggingface.co redirects to its CDN. Only when you download a model; the token, if any, goes only to huggingface.co. |
github.com/ggml-org/llama.cpp · github.com/earendil-works/pi | The releases of llama.cpp and Pi, as for the other components published on GitHub (they are in the table of sources below). |
github.com/nabre/atollo/issues | “Report a problem” opens a new issue here in the browser, with version and system in the address. You open it, in your browser: the app sends nothing, and nothing reaches GitHub until you create the issue. |
registry.npmjs.org · pypi.org · packagist.org… | Only when the commands of projects and frameworks ask for it. |
Complete table of sources (39 components and 5 parts)
For each component: where the kit reads the versions from, where it downloads the file from, how it verifies it and where it puts it. The columns describe Windows; where macOS and Linux use another source, it is written under the address.
| Component | Versions from | Files from | Check | In data\apps\<system>\ |
|---|---|---|---|---|
| PowerShell 7 (pwsh) | api.github.com/repos/PowerShell/PowerShell/releases/latest | PowerShell-<v>-win-(x64|arm64).zip | SHA-256 GitHub Release asset.digest | pwsh\<line>\pwsh.exe |
| GitHub CLI (gh) | api.github.com/repos/cli/cli/releases/latest | gh_<v>_windows_(amd64|arm64).zip | SHA-256 GitHub Release asset.digest | gh\<line>\bin\gh.exe |
| Editor (VSCodium Reh Web) | Built-in catalog (pinned version 1.135.06055, D-58) | github.com/VSCodium/vscodium/releases/download/<v>/vscodium-reh-web-win32-x64-<v>.tar.gzmacOS and Linux: vscodium-reh-web-<target>-<v>.tar.gz, SHA-256 pinned per target (native on ARM64 too) | SHA-256 SHA-256 hardcoded in components.json | vscodium-server\ |
| ConPTY (conpty.dll + OpenConsole.exe) | Built-in catalog (pinned version 1.25.260930003, D-148) | api.nuget.org/v3-flatcontainer/microsoft.windows.console.conpty/<v>/microsoft.windows.console.conpty.<v>.nupkgWindows only: on macOS and Linux the terminal uses the system's PTY | Authenticode + SHA Package SHA-256 hardcoded in components.json (NuGet's SHA-512); conpty.dll and OpenConsole.exe signed by Microsoft Corporation | conpty\ |
| Claude Code | registry.npmjs.org/@anthropic-ai/claude-code-win32-<arch>/latest | dist.tarball field of the npm package | Authenticode + SHA npm sha512 integrity + Anthropic Authenticode signature | claude\<line>\claude.exe |
| Codex (OpenAI) | registry.npmjs.org/@openai/codex/latest → /<ver>-win32-<arch> | dist.tarball field of the architecture-specific package | npm sha512 npm dist.integrity (sha512-...) | codex\<line>\bin\codex.exe |
| Antigravity (Google) | antigravity-cli-auto-updater-974169037036.us-central1.run.app/manifests/windows_(amd64|arm64).json | url field of the official JSON manifestmacOS and Linux: manifests/<os>_<arch>.json, .tar.gz archive | SHA-512 SHA-512 (128 hex) from the manifest sha512 field | antigravity\<line>\agy.exe (via data\kit\bin\agy.cmd) |
| Pi (Earendil) | api.github.com/repos/earendil-works/pi/releases/latest | github.com/earendil-works/pi/releases/download/v<v>/pi-windows-<arch>.zipmacOS and Linux: pi-<os>-<arch>.tar.gz of the same release | SHA-256 GitHub's SHA-256 digest (or the release's SHA256SUMS) | pi\<line>\pi.exe |
| llama.cpp (llama-server) | build bNNNNN pinned in Atollo's catalog (D-151) | github.com/ggml-org/llama.cpp/releases/download/<b>/llama-<b>-bin-win-vulkan-<arch>.zipLinux: llama-<b>-bin-ubuntu-vulkan-<arch>.tar.gz; macOS: llama-<b>-bin-macos-<arch>.tar.gz (Metal) | SHA-256 SHA-256 per platform pinned in the catalog (from GitHub's digest) | llama\llama-server.exe |
| Git + Git Bash (PortableGit) | api.github.com/repos/git-for-windows/git/releases/latest | PortableGit-<v>-(64-bit|arm64).7z.exe (extracted in Rust)macOS and Linux: GitHub desktop/dugite-native (dugite-native-v<v>-<sha>-<system>.tar.gz, the asset's .sha256), follows the kit | SHA-256 GitHub Release asset.digest | git\<line>\cmd\git.exe and git\<line>\bin\bash.exe |
| Python + pip | raw.githubusercontent.com/astral-sh/python-build-standalone/latest-release/latest-release.json | cpython-3.<minor>.<patch>+<date>-<triple>-install_only_stripped.tar.gz | SHA-256 SHA-256 from the official SHA256SUMS list | python\<line>\python.exe (+ pip) |
| Node.js + npm | nodejs.org/dist/index.json (even LTS >= 18 + latest major) | nodejs.org/dist/<v>/node-<v>-win-<arch>.zip | SHA-256 SHA-256 from nodejs.org/dist/<v>/SHASUMS256.txt | node\<line>\node.exe |
| uv (uv, uvx, uvw) | api.github.com/repos/astral-sh/uv/releases/latest | uv-<triple>.zip | SHA-256 GitHub Release asset.digest | uv\<line>\uv.exe, uvx.exe, uvw.exe |
| PHP (Thread Safe) | windows.php.net/downloads/releases/releases.json (+ EOL archives 8.1..5.6) | windows.php.net/downloads/releases/php-<v>-Win32-vs*-x64.zipmacOS and Linux: static-php-cli “bulk”, cli and fpm archives with SHA-256 pinned in the catalog (8.4 and 8.5) | SHA-256 SHA-256 from releases.json (or verified EOL table) | php\<line>\php.exe |
| ↳ Part: Composer | getcomposer.org/versions (stable channel or 2.2 LTS for PHP < 7.2.5) | getcomposer.org/download/<v>/composer.phar | SHA-256 SHA-256 from <url>.sha256sum | php\<line>\composer.phar (+ composer.cmd) |
| ↳ Part: SSL CA Bundle (curl) | curl.se/ca/cacert.pem.sha256 | curl.se/ca/cacert.pem | SHA-256 SHA-256 from cacert.pem.sha256 | php\<line>\extras\ssl\cacert.pem |
| ↳ Part: Visual C++ Runtime | Extracted from CAB vcRuntimeMinimum_amd64\cab1.cab if missing | aka.ms/vc14/vc_redist.x64.exeWindows only | Authenticode + SHA Authenticode signature O=Microsoft Corporation on exe and vcruntime140.dll | tools\vcruntime\ (copied into PHP, Apache, MongoDB) |
| Apache httpd | apachelounge.com/download/ (version and checksum scraping) | apachelounge.com/download/VS<nn>/binaries/httpd-<v>-Win64-VS<nn>.zipmacOS and Linux: the kit's build, github.com/nabre/atollo/releases/download/httpd-v<v>/httpd-<v>-<target>.tar.gz, SHA-256 pinned per target in the catalog, PHP through php-fpm (D-116) | SHA-256 SHA-256 from <url>.txt (SHA256-Checksum for:) | apache\<line>\bin\httpd.exe |
| Caddy | api.github.com/repos/caddyserver/caddy/releases?per_page=100 | caddy_<v>_windows_amd64.zip asset from the official GitHub release | SHA-256 GitHub Release asset.digest (from 2.10.1), otherwise SHA-512 from caddy_<v>_checksums.txt | caddy\<line>\caddy.exe |
| Rust (rustup, cargo, clippy) | static.rust-lang.org/dist/channel-rust-stable.toml ([pkg.rustc]) | static.rust-lang.org/rustup/dist/<triple>/rustup-init.exeHost gnu on Windows x64, gnullvm on Windows ARM64 (with C/C++), msvc from Rust's page in Tools (“Details”); macOS and Linux: rustup with the native host | SHA-256 SHA-256 from <url>.sha256 | rust\cargo\bin\rustc.exe and rustup.exe |
| Go SDK | go.dev/dl/?mode=json (&include=all) | go.dev/dl/go<v>.windows-(amd64|arm64).zip | SHA-256 SHA-256 from the sha256 field of the official JSON | go\<line>\bin\go.exe |
| Java JDK (Eclipse Temurin) | api.adoptium.net/v3/info/available_releases + /v3/assets/latest/<major>/hotspot | .zip package returned by the Adoptium API | SHA-256 SHA-256 from binary.package.checksum | java\<line>\bin\java.exe |
| ↳ Part: Apache Maven | repo.maven.apache.org/maven2/org/apache/maven/apache-maven/maven-metadata.xml | apache-maven-<v>-bin.zip | SHA-512 SHA-512 from <url>.sha512 | maven\bin\mvn.cmd |
| ↳ Part: Gradle | services.gradle.org/versions/current | downloadUrl field of the official JSON | SHA-256 SHA-256 from checksumUrl of the JSON | gradle\bin\gradle.bat (via data\kit\bin\gradle.cmd) |
| Kotlin Compiler | api.github.com/repos/JetBrains/kotlin/releases?per_page=100 | Asset kotlin-compiler-<v>.zip | SHA-256 GitHub asset.digest or <asset>.sha256 | kotlin\<line>\bin\kotlinc.bat |
| Android SDK + Command-line Tools | developer.android.com/studio (commandlinetools-win-*_latest.zip table) | dl.google.com/android/repository/commandlinetools-win-<build>_latest.zip | SHA-256 SHA-256 published in the official Android table | android\cmdline-tools\latest\bin\sdkmanager.bat and adb.exe |
| .NET SDK | builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json | .zip archive for rid=win-x64|win-arm64 | SHA-512 SHA-512 from the hash field of releases.json | dotnet\<line>\dotnet.exe (with shared SDK junctions) |
| Dart SDK | storage.googleapis.com/dart-archive/channels/stable/release/latest/VERSION | dartsdk-windows-<arch>-release.zip | SHA-256 SHA-256 from <url>.sha256sum | dart\<line>\bin\dart.exe |
| Zig | ziglang.org/download/index.json | tarball field for (x86_64|aarch64)-windows | SHA-256 SHA-256 from the shasum field of the JSON | zig\<line>\zig.exe |
| Julia | julialang-s3.julialang.org/bin/versions.json | .zip archive for os=winnt, arch=x86_64 | SHA-256 SHA-256 from the sha256 field of versions.json | julia\<line>\bin\julia.exe |
| Bun | api.github.com/repos/oven-sh/bun/releases | Asset bun-windows-(x64|aarch64).zip | SHA-256 GitHub asset.digest or SHASUMS256.txt | bun\<line>\bun.exe |
| Deno | api.github.com/repos/denoland/deno/releases | Asset deno-(x86_64|aarch64)-pc-windows-msvc.zip | SHA-256 GitHub asset.digest or <asset>.sha256sum | deno\<line>\deno.exe |
| Typst | api.github.com/repos/typst/typst/releases | Asset typst-(x86_64|aarch64)-pc-windows-msvc.zip | SHA-256 GitHub Release asset.digest | typst\<line>\typst.exe |
| TinyTeX (LaTeX) | api.github.com/repos/rstudio/tinytex-releases/releases/latest | Asset TinyTeX-1-windows-v*.exe (7z SFX extracted in Rust)macOS and Linux: TinyTeX-1-<os>-<arch>-v*.tar.xz (universal on macOS) | SHA-256 GitHub Release asset.digest | tinytex\bin\windows\tlmgr.bat and pdftex.exe |
| pnpm + yarn (corepack) | registry.npmjs.org/pnpm/latest and /corepack/latest | Installed via npm-cli.js of the kit's Node.js | npm sha512 npm registry integrity | data\npm-global\pnpm.cmd and yarn.cmd |
| CMake + Ninja | GitHub API: Kitware/CMake and ninja-build/ninja (releases/latest) | cmake-*-windows-(x86_64|arm64).zip and ninja-win(arm64).zip | SHA-256 GitHub Release asset.digest | cmake\<line>\bin\cmake.exe and tools\ninja.exe |
| C/C++ (llvm-mingw) | api.github.com/repos/mstorsjo/llvm-mingw/releases/latest | Asset llvm-mingw-*-ucrt-(x86_64|aarch64).zipmacOS and Linux: cc, c++, gcc, g++, clang shims over the kit's zig cc (needs Zig) and GNU make from conda-forge, not relocatable | SHA-256 GitHub Release asset.digest | cc\bin\clang.exe (+ make.cmd) |
| Ruby + Bundler | api.github.com/repos/oneclick/rubyinstaller2/releases?per_page=30 | Asset rubyinstaller-<v>-(x64|arm).7zmacOS and Linux: conda-forge ruby (3.2 and later) via micromamba, not relocatable | SHA-256 GitHub Release asset.digest | ruby\<line>\bin\ruby.exe |
| R (conda-forge + OpenBLAS) | api.anaconda.org/package/conda-forge/r-base + mamba-org/micromamba-releases | micromamba-win-64 + r-base and libblas=*=*openblas packagesWindows ARM64: the win-64 packages under x64 emulation, from the native micromamba (--platform win-64). macOS and Linux: the same packages for osx-* and linux-*, launchers in kit-bin, not relocatable | SHA-256 micromamba SHA-256 + conda-forge package SHA-256 | r\<line>\bin\R.cmd and Rscript.cmd |
| MySQL Community Server | 8.4 and 9.7 LTS lines pinned in the catalog (sha256ByLine) | cdn.mysql.com/Downloads/MySQL-<line>/mysql-<v>-winx64.zip | SHA-256 SHA-256 pinned per line and target after Oracle's GPG signature | mysql\<line>\bin\mysqld.exe and mysql.exe |
| MongoDB + mongosh + Database Tools | downloads.mongodb.org/current.json, GitHub mongodb-js/mongosh, tools/db/release.json | Windows x64 .zip archives of mongod, mongosh and mongodump/mongorestoremacOS: vendor archives; Linux: server from conda-forge (not relocatable), generic mongosh, Database Tools per distribution | SHA-256 SHA-256 from MongoDB JSONs + GitHub asset.digest for mongosh | mongodb\<line>\bin\mongod.exe, mongosh\, mongodb-tools\ |
| phpMyAdmin (for MySQL) | www.phpmyadmin.net/home_page/version.json | files.phpmyadmin.net/phpMyAdmin/<v>/phpMyAdmin-<v>-all-languages.zip | SHA-256 SHA-256 from the official .sha256 file + php -l syntax check | phpmyadmin\<line>\index.php |
| mongo-express (for MongoDB) | version pinned in Atollo's catalog (the kit's build, D-147) | github.com/nabre/atollo/releases/download/mongo-express-v<v>/mongo-express-<v>.zip | SHA-256 SHA-256 pinned in the catalog (or the .sha256 of the kit's release); built in CI from mongo-express's pinned commit | mongo-express\<line>\app.js |
| SQLite CLI | sqlite.org/download.html (PRODUCT,... CSV rows) | sqlite.org/<year>/sqlite-tools-win-(x64|arm64)-<v>.zipLinux ARM64: conda-forge sqlite (sqlite.org publishes no tools), not relocatable; Windows ARM64: the x64 zip when there is no arm64 one | SHA3-256 SHA3-256 published in the PRODUCT row of the official page | sqlite\<line>\sqlite3.exe |
Under the hood
- Work folder: <system temp>\Atollo\<kit id>\setup, or data\tmp\setup if the system disk has less than 4 GB free or cannot be written to.
- Three attempts 5 and 10 seconds apart; the download starts over at every attempt.
- Connections use the proxy of Settings and the system's certificates plus those of “Additional certificates (PEM file)”: a firewall's HTTPS inspection works if its certificate is installed on the PC or is in that file.
- The installed version is written in data\app\versions\<system>\<component>.txt.