Re: Self-contained single-file web applications

Hi Demi,

ICYMI you may want to check out the Web Packaging (wpack) work [1] that concluded a few years ago.

I wasn't able to deliver on its milestones. Not sure how similar or different it is to what you have in mind.

Cheers
Lucas

[1] https://datatracker.ietf.org/wg/wpack/about/

On Fri, Jun 5, 2026, at 16:27, Demi Marie Obenour wrote:
> It would be very nice to be able to ship a web application as a single,
> self-contained file or directory tree.  This has numerous advantages:
> 
> - It doesn't load code remotely, so it can be used when the server
>   can't be trusted.  For instance, it can be used by end-to-end
>   encrypted messaging applications.
> 
> - It is very suitable for local development.
> 
> - Distribution package managers can easily update it automatically.
>   Platforms without one can ship a tiny native launcher and updater.
>   
> - It doesn't depend on a local web server or setting up local TLS
>   certs.
> 
> From a security perspective, I think the whole bundle should
> be considered a unique origin and identified by either digital
> signature, trusted manifest file, or local configuration.  If the
> bundle is installed in a well-known system-wide or per-user location,
> the path alone (relative to the home directory in the latter case)
> should be sufficient.
> -- 
> Sincerely,
> Demi Marie Obenour (she/her/hers)
> 
> 
> *Attachments:*
>  • OpenPGP_0xB288B55FFF9C22C1.asc
>  • OpenPGP_signature.asc