Box Sources

When installing a package using umbox install, or by adding it to the dependency list, it is possible to specify, where the box should be sourced. By default, if you don't specify anything, it is downloaded from the official server at


The syntax is very simple:


Source types

Currently there are two source types supported:

  • http or https - download from an UmBox server
    • source specifies the URL of the server
  • file - install from a local (or a remote :] ) box.tar file
    • source specifies the path to the file

Dependency shadowing

Let's consider the following scenario:

  • Our box depends on box2 and logs
  • box2 also depends on logs

UmBox will use the dependency source of the first reference to a box it sees. In this case, logs will be installed from a file, even for box2:

"dependencies": {

In this case, logs will be installed from the source specified by box2, even though we specify a different source ourselves:

"dependencies": {

It is a good idea to specify dependencies with custom sources first in the list to prevent any unexpected behavior.


Download from the official server:


Download from an alternative server:


Install from a file using relative path:


Install from a file using absolute path: