hexforge manual / obtaining hexforge
Obtaining HexForge
HexForge is distributed as source, and only as source. What follows is the listing of the release directory, exactly as the server returns it, followed by the two commands you should run before you trust any of it.
No binaries. There is no .deb, no formula, no image. One person cannot carry binary builds across every libc and still answer the mail, so the choice was made early to ship a tarball and a signature and nothing else. If a packaged build exists somewhere, it is not from here and not supported here.
Index of /pub/hexforge/
Name Last modified Size ../ latest/ -> 0.7.2/ 2026-10-03 12:04 - 0.7.2/ 2026-10-03 11:58 - 0.7.1/ 2026-09-07 09:11 - 0.7.0/ 2026-08-22 14:40 - 0.6.0/ 2026-05-14 08:02 - 0.5.0/ 2026-02-09 19:27 - 0.4.0/ 2025-10-30 10:15 - 0.3.0/ 2025-06-18 22:49 - 0.2.0/ 2024-11-12 13:30 - 0.1.0/ 2024-05-20 17:00 - SHA256SUMS 2026-10-03 11:58 1134 SHA256SUMS.sig 2026-10-03 11:58 566 signing-key.asc 2024-05-18 00:00 3103
The listing is flat on purpose: one directory per release, a per-file checksum manifest at the top level, one detached signature over that manifest, and the public key. There is no HEAD tarball and no nightly; if you want the unreleased tree you check it out, you do not download it.
Index of /pub/hexforge/0.7.2/
Name Last modified Size ../ hexforge-0.7.2.tar.gz 2026-10-03 11:57 1114223 hexforge-0.7.2.tar.gz.sig 2026-10-03 11:57 566 hexforge-0.7.2.tar.gz.sha256 2026-10-03 11:57 92 NEWS 2026-10-03 11:40 8841 README 2026-10-03 11:40 2204
Verifying a download
Do both of these. The checksum tells you the file arrived intact; the signature tells you it is the file the maintainer actually cut. A matching checksum over a tampered file signed by nobody is worth nothing.
# 1. checksum
$ sha256sum -c hexforge-0.7.2.tar.gz.sha256
hexforge-0.7.2.tar.gz: OK
# 2. signature (import signing-key.asc once, first)
$ gpg --verify SHA256SUMS.sig SHA256SUMS
gpg: Good signature from "HexForge release signing <hexforge@hexforge.cloud>"The signing key changes when it is going to change, announced on the list a release ahead of time, never silently. The current key's fingerprint ends 7B31 A9C4; if your copy of signing-key.asc ends in anything else, stop and ask on the list before building.
After you have the tarball
Unpack it and read README, which is short. The build itself is on the install page - one cmake invocation, GCC 12 or newer, about three and a half minutes on eight cores. The tarball carries no generated files, so a clean checkout and a clean tarball build byte-identical binaries; that is checked in CI and is the reason there is no separate "source" versus "dist" tarball.
Older releases
Every release that was ever cut is still in the directory, including 0.1.0 from 2024-05-20, which only targets the T4-12K and will not read a modern .hxn. They are kept for bisecting regressions, not because anyone should run them. Note that the netlist format changed at 0.7.0 and there is no converter in either direction - a .hxn from 0.6.0 is scrap to 0.7.2 and vice versa.