Installing SumSheet

Exactly what gets installed

SumSheet is a spreadsheet editor. Inside the installed application is the Rust processor compute_contract_cli. It accepts JSON requests, holds the open workbook in the current process’s memory, and returns JSON responses.

Item	Role	Boundary
SumSheet.app	The spreadsheet editor’s user interface	A person opening and editing workbooks
compute_contract_cli	The operations contract in the Rust core	Open, read, edit, history, computation, and save
subsetId	The identifier of an open workbook session	Lives only inside a single command-line program process
sheetKey	A stable sheet key	Taken from activeSheet.path; never substitute the sheet’s name
viewport	The viewport: only the visible part of the sheet goes outward	The workbook never unfolds entirely into memory
result.xlsx	The physical OOXML package	The result of save_workbook_subset

Architectural takeaway

XLSX → open_workbook_subset → sparse workbook session → apply/read/history → save_workbook_subset → XLSX

Strength

The same core serves both the desktop app and an external integration process. The shell never has to implement its own semantics for formulas, history, or saving.

Limit

This is a process API, not an HTTP API. A browser can’t run a local binary directly. For a server or a web UI on top of it, you need a controlled service host; the scheme is on the Integrating into an application page.

Filenames in the examples are given without the build number

In the release catalog, the filename carries a version number built as “year.quarter.patch.build”: SumSheet-<year>.<quarter>.<patch>.<build>-mac-arm64.zip, and the same for the other systems. Take the exact number from the release catalog — in the commands below it’s replaced with an ellipsis or a substitution, so you can run them as is, without matching up digits.

The installed version is visible in the application itself: the SumSheet → About SumSheet menu. The installation folder doesn’t depend on the version number, so the paths in the examples stay correct even after an update.

Download SumSheet

1. Open the release directory. In the browser, open dl.layers.md. The directory is laid out by system: the folders macos/, windows/, linux/, webhost/ (the web host image archive with INSTALL.md — the server path) and sdk/ (the mobile viewer kit for Android and iOS with checksums, once it is released under this brand — Phone and tablet); the root holds only manifest.json with the version number and release notes.

2. Choose the package for your system.

macOS

In the macos/ folder: a file like SumSheet-…-mac-arm64.zip for Apple Silicon computers and SumSheet-…-mac-x64.zip for Intel Macs.

Windows

In the windows/ folder: a file like SumSheet-…-x64-setup.exe, the regular installer for Intel and AMD machines. For ARM machines (Snapdragon, Surface) the same folder holds SumSheet-…-arm64-setup.exe: the native build runs faster than emulation.

Linux

In the linux/ folder: SumSheet-….deb for Debian and Ubuntu, SumSheet-….rpm for Fedora and RHEL, or SumSheet-….AppImage, which runs without installation.

3. Download the checksum list. The folder you took the package from also holds SHA256SUMS — sha256 sums of all its files. The latest-*.yml files next to it serve the application auto-update and are not needed for manual verification.

The same thing in one command

macOS

mkdir -p ~/Downloads/f1-first-run
cd ~/Downloads/f1-first-run

base=https://dl.layers.md/sumoffice/sumsheet/release/latest/macos
curl -fsSLO $base/SHA256SUMS
# take the filename with the version number from the same list
curl -fLO $base/$(awk '/mac-arm64.zip$/ {print $2; exit}' SHA256SUMS)

Windows

mkdir $HOME\Downloads\f1-first-run -Force
cd $HOME\\Downloads\\f1-first-run

$base = "https://dl.layers.md/sumoffice/sumsheet/release/latest/windows"
Invoke-WebRequest "$base/SHA256SUMS" -OutFile SHA256SUMS
# take the filename with the version number from the same list
$name = (Select-String -Path SHA256SUMS -Pattern 'x64-setup\.exe$').Line.Split(' ')[-1]
Invoke-WebRequest "$base/$name" -OutFile $name

Linux

mkdir -p ~/Downloads/f1-first-run
cd ~/Downloads/f1-first-run

base=https://dl.layers.md/sumoffice/sumsheet/release/latest/linux
curl -fsSLO $base/SHA256SUMS
# take the filename with the version number from the same list
curl -fLO $base/$(awk '/amd64.deb$/ {print $2; exit}' SHA256SUMS)

Checksum verification

macOS

cd ~/Downloads/f1-first-run
# SHA256SUMS was downloaded in the previous step from the macos/ folder
shasum -a 256 -c SHA256SUMS --ignore-missing

Expect the line SumSheet-…-mac-arm64.zip: OK.

Windows

cd $HOME\Downloads\f1-first-run
# SHA256SUMS was downloaded in the previous step from the windows/ folder
$hash = (Get-FileHash .\SumSheet-*-setup.exe -Algorithm SHA256).Hash.ToLower()
Select-String -Path SHA256SUMS -Pattern $hash

The line was found — the checksum matches.

Linux

cd ~/Downloads/f1-first-run
# SHA256SUMS was downloaded in the previous step from the linux/ folder
sha256sum -c SHA256SUMS --ignore-missing

Expect the line SumSheet-…-amd64.deb: OK.

Stop condition

If the checksum differs, don’t run the package. Delete the downloaded file and download again from the release/latest catalog.

Install and verify SumSheet

Extraction

macOS

cd ~/Downloads/f1-first-run
mkdir -p unpacked
ditto -x -k SumSheet-*-mac-*.zip unpacked
ditto unpacked/SumSheet.app ~/Applications/SumSheet.app

Windows

Run the downloaded SumSheet-…-setup.exe and go through the installer. Installation applies to the whole machine, so you’ll need administrator rights. The default folder is C:\Program Files\SumSheet; you can change it in the installer itself.

Linux

cd ~/Downloads/f1-first-run

# Debian, Ubuntu, and derivatives
sudo apt install ./SumSheet-*.deb

# Fedora, RHEL, and derivatives
sudo dnf install ./SumSheet-*.rpm

The package installs to /opt/SumSheet.

Verifying the signature and notarization

Verify the app, not the image

It is the SumSheet.app application itself that is signed and notarized with Apple. The .dmg image it is distributed in carries a notarization ticket but has no code signature: codesign and spctl on the image file itself answer with a refusal. This is not a delivery defect — Gatekeeper checks the app on first launch and accepts it. Mount the image or unpack the .zip archive from the same directory and run the checks below on SumSheet.app.

The certificate carries the legal entity’s name, not the product name: Developer ID Application: HEALTH INFORMATIC SECURITY SYSTEM SL (K58GV7E7X4). That’s expected — check it against this team identifier.

On Windows the signature is not yet production-grade. The installer is signed with the test certificate FastOffice Test Signing (DEVELOPMENT ONLY), the system will show exactly that name, and the root of that certificate is not among the trusted ones — you will get an unknown-publisher warning. The timestamp is set by DigiCert, but it is not the signature issuer. Until a production certificate arrives, the only reliable check on Windows is the checksum from SHA256SUMS in the windows/ folder.

macOS

APP="$HOME/Applications/SumSheet.app"
codesign --verify --deep --strict --verbose=2 "$APP"
spctl -a -vv "$APP"

Expect a successful codesign check and the line accepted with Notarized Developer ID from spctl.

Windows

Get-AuthenticodeSignature "C:\Program Files\SumSheet\SumSheet.exe" |
  Format-List Status, SignerCertificate

Expect Status: Valid. A NotSigned value means the file didn’t come from the release catalog — don’t run such a package.

Linux

The package manager checks package integrity during installation: apt and dnf will reject a package with corrupted content. No separate command is needed — the checksum check from the previous step is enough.

Next to the .deb package and the AppImage in the linux/ folder there is a detached signature — an .asc file — and the public key fastoffices-signing-key.asc; the .rpm package has no detached signature. The check is the same as for SumDoc:

base=https://dl.layers.md/sumoffice/sumsheet/release/latest/linux
curl -fsSLO $base/fastoffices-signing-key.asc
gpg --import fastoffices-signing-key.asc
curl -fsSLO $base/$(awk '/amd64.deb.asc$/ {print $2; exit}' SHA256SUMS)
gpg --verify SumSheet-*-amd64.deb.asc SumSheet-*-amd64.deb

The key comes from the same server as the package and proves nothing on its own — verify the fingerprint you received from us through another channel.

Expect a successful codesign check and the line accepted / Notarized Developer ID from spctl.

First launch of the interface

macOS

open ~/Applications/SumSheet.app

Windows

Launch SumSheet from the Start menu or the desktop shortcut — the installer creates both.

Linux

/opt/SumSheet/f1

Open any XLSX workbook and confirm the grid is visible. After that, you can close SumSheet: the next section uses the built-in Rust processor directly.

Find the processor

macOS

F1_CLI="$HOME/Applications/SumSheet.app/Contents/Resources/runtime/native/compute_contract_cli"
file "$F1_CLI"
test -x "$F1_CLI" && echo "processor ready"

Windows

$F1_CLI = "C:\Program Files\SumSheet\resources\runtime\native\compute_contract_cli.exe"
Test-Path $F1_CLI

A True response means the processor is in place.

Linux

F1_CLI="/opt/SumSheet/resources/runtime/native/compute_contract_cli"
file "$F1_CLI"
test -x "$F1_CLI" && echo "processor ready"

Verified locally

The file is an arm64 Mach-O executable; the application’s signature is valid, and Gatekeeper accepts the application.

What’s next

The processor is installed — from here there are four paths:

• Confirm the API responds. Quick start: open a workbook, write a value and a formula, save the result.
• Understand how the session works. How the API session works: transport, response contents, and handling refusals.
• See the calls broken down. Requests from the example — exactly what’s sent at each step.
• See finished code. Examples — twenty-three small projects, each shown in full.

If something won’t start — diagnostics.