Self-contained single-file web applications

It would be very nice to be able to ship a web application as a single,
self-contained file or directory tree.  This has numerous advantages:

- It doesn't load code remotely, so it can be used when the server
  can't be trusted.  For instance, it can be used by end-to-end
  encrypted messaging applications.

- It is very suitable for local development.

- Distribution package managers can easily update it automatically.
  Platforms without one can ship a tiny native launcher and updater.
  
- It doesn't depend on a local web server or setting up local TLS
  certs.

From a security perspective, I think the whole bundle should
be considered a unique origin and identified by either digital
signature, trusted manifest file, or local configuration.  If the
bundle is installed in a well-known system-wide or per-user location,
the path alone (relative to the home directory in the latter case)
should be sufficient.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

Received on Friday, 5 June 2026 15:28:09 UTC