Real installers for Windows, Linux and macOS, straight from a GitHub repo.
No freezing and no bundlers that break. We install your project's real
runtime and dependencies into a folder of its own, then install your
project against them. Windows installers are built with NSIS, and on
Linux and macOS the installer is one POSIX shell script
with no framework to install.
TiddlyInstall is a single HTML file. This page carries the installer
programs, the runtime catalogue, and all the code that makes, edits and signs them.
With no server at all
Code you write here, a package, or a GitHub repository pinned to a commit. It edits any
installer nobody has signed, packs the runtimes inside for machines with no internet, and
signs with your own key. A copy saved to your disk asks nothing of the network except the
runtime mirror, so a GitHub branch has to be given as a commit there.
What the server adds
Two things. It signs the install script, so an installer can check the script came from
us and reached it unaltered. And it is where installers signed by us would be built,
once there is a certificate to sign them with - there is not one yet, so that option is off.
Everything else above is this page's own work.
about 6 MB, and it is the whole product
03 How it works
Three steps, no surprises
Step one
Point at a repo
Give us a GitHub repository and a branch, tag or commit. We clone the actual source code.
Step two
Dependencies are handled for you
At install time it picks the newest runtime that matches your version range and runs
on that computer, then installs it into the app's own folder.
Step three
Build for every platform
An ordinary .exe for Windows, built with NSIS, plus a .run
for Linux and a .zip for macOS - three real installers.
04 Isolation
Every app gets its own folder
Each app gets its own copy of every dependency, in folders with short hashed
names. Nothing is shared, so one app can never break another, and uninstalling just deletes the
app's folders. Disk space is cheap; broken installs are not.
Windows C:\ti\k3m9q2x7v4p8\ the app
C:\ti\tjfq5rqwnnrx\ its Python 3.12.4
C:\ti\a7d2hx9q4mbe\ its git 2.46.0
Linux /opt/ti/tjfq5rqwnnrx/
macOS /Library/Application Support/ti/tjfq5rqwnnrx/
05 No repo yet
Write the app here
Pick Python, JavaScript (Node.js) or Ruby and a template - a script, a window
app, a web page in a window or a tray app - then write your code in the browser, run it, and make
an installer from it with the same pipeline, on the New installer page.
We wrote one installer program - the base installer - and
every installer built here is that same program plus your settings. For example,
install_python_x.exe is that program, with settings that say "install the Python
package x". The code is identical in every copy and only the settings change, which
is why the program itself only has to be tested, hardened and signed once rather than once per app.
install_python_requests.exe -> installs the "requests" package
install_python_black.exe -> installs the "black" package
install_node_prettier.exe -> installs the "prettier" package
07 Signing
Three ways to ship
A signature here is on the installer program - the one
we wrote, identical in every copy - and never on the software it installs. It works like
the signature on a web browser: it says who wrote the browser and that this copy is
unmodified, and nothing about the sites you visit. The program that asks for your trust at
install time is ours and unaltered, so the screen it shows you can be believed.
Mode A
We sign the installer
The fewest security warnings. Settings live in the file name, so renaming the file
points it at a different package - and the signature stays valid, because it was
never a claim about what gets installed.
Mode B
You sign the installer
Your name and icon on the installer itself, with your own certificate and your own reputation.
Mode C
Nobody signs it
Fully editable. Change what it installs, its name and its icon in your browser, without
uploading the file.
08 The promise
Nothing hidden
Every installer, whoever signed it, shows what it will install, where it
comes from, what it downloads, where the files go and who signed the installer file, before it
changes anything.
That screen - the one at the top of this page - is not a summary we wrote afterwards.
It is read from the installer's own settings block, which is the same block the installer
follows, so it cannot disagree with what happens next.
What that screen can prove, and what it cannot, is worth its own page:
which parts are signed by us, which are the publisher's word, and how an installer checks
any of it on a machine with no internet connection.
You can close this page and come back: the address keeps your place.
Waiting for the server…
02 Downloads
Your installers
File
Platform
Architectures
Size
Signed by
On a phone or tablet, tapping a file saves it to your downloads
(on iPhone and iPad Safari asks first, then it is in the Files app, under Downloads). The installers run on Windows, Linux and macOS,
not on a phone: copy them to a computer, or make them there.
This browser can't save files from a page (on iPhone and iPad
that needs iOS 13 or later), so these links may only open the file. Make the installers on a computer instead.
Change what an installer installs, its name and its icon, in your browser.
Your file is never uploaded. Only an unsigned installer can be edited: a signature
covers the whole file, so any change breaks it.
One file, with the Windows, Linux and macOS base installers inside.
It works offline, from a USB stick or any web host.
01 Open
Open an installer
One made on this site with no signature on it.
Or drop it here. .exe for Windows, .run for Linux, .zip for macOS.
Or start a new one from a base installer
A base installer is the reusable program with no settings in it yet: the part we wrote, which installs whatever its settings name. They come from the server, or from inside this page when it is the self-contained editor.
A signature covers every byte of the installer file, so editing breaks it.
If you open a signed installer, it will be saved with no signature, and Windows and macOS will warn people who run it.
An installer we signed needs no editing to point it elsewhere: rename it instead.
Installers we signed
Point one at another package by renaming it
An installer we signed takes its settings from its file name. Our signature is over the installer
program, and never covered the name, so renaming leaves it as valid as it was: it still says the program is ours
and unaltered, which is all it ever said.
install_python_requests.exe installs requests
install_python_black.exe installs black
Names are limited to 255 characters. Letters, numbers, _-. only.
Verify Installer
See what an installer will do, without running it
Drop an installer here and it is read in this page: what it installs, what it
downloads, what it runs, and who signed what. Nothing is executed, and with no server
set the file never leaves your computer.
Drop an installer here, or
.
A Windows .exe, a Linux .run,
or a macOS .zip. Large files are hashed in pieces.
Reading it...
This is a copy of TiddlyInstall
The file
What it installs
Neither this file nor its name says what to install, so no runtime setup
could be read or worked out.
One of these, whichever machine it runs on
Machine
Runtime it installs
Download
From
Commands it runs
Who signed what
A signature on the installer says who wrote the installer and that
it has not been altered since. The runtime setup is signed separately, ahead of time, and is proved here
against that signature -- that is the part we wrote. The choices are signed only when our build server
made this file; one built in a web page cannot sign them, because a page holds no key. None of it says
anything about the software being installed.
Checked against the server
No server is set, so only what is inside the file could be
read. A server can also say whether it published these choices, whether it would still build the same
thing today, and whether this installer has been withdrawn since it was built.
Catalogue Registry
Registry
The catalogue this page builds from: every runtime release it can install, the steps
that install it, and the systems each one runs on. Change it here. Your changes stay in this
browser, as a short list on top of the catalogue built into the page.
This copy of the page has no catalogue inside it. The runtime editor works in the one-file site (out/index.html, or a copy saved with “Save this page”).
Loading the catalogue…
No changes
Drop every change made in this browser and go back to the catalogue built into the page?
This replaces the whole catalogue in this page with the one that server is
serving now - every release, recipe and rule, for every runtime. The list you are looking
at will not be the same list afterwards. Your own changes are kept: they are a short list that
sits on top, and they are applied again to the new catalogue (any that no longer fit are shown
as not applied).
The page checks what it is handed before it uses any of it. The server sends a
statement of the catalogue's SHA-256, signed with the TiddlyInstall key; this page checks that
signature against the key it was built with, then checks the file against the statement. If
either fails, nothing changes.
What's changed
Imported file
Review the imported changes
Nothing from this file is used until you apply it. Recipes run commands on the computers your installers go to, and sources decide what they download: read each change first.
VersionOSArchVariantFormatFile
A recipe is how a release gets installed: the steps run on the user's computer. The resolver picks, for each release, the recipe whose match fields fit it best.
Support rules say which OS versions a release runs on. A release with no rule falls back to the catalogue's default floor.
Check before you save
Preview: the script the resolver makes
Worked out in this page by the same resolver builds use, with your changes (and the edit you're making, once it's valid) against the catalogue built into the page.
Plan lines that changeThe whole plan, with your changes
Trust
What you are trusting, and why
An installer is a program that changes your computer. It answers two questions, and only one of the answers is ours to prove.
01 The short version
Two questions, two different answers
What does it install?
Proved. Signed by us in advance, checked by your machine with no network.
Is the program any good?
Not proved by us. That is the publisher's word, and their signature on the file.
We sign what we wrote, and nothing else. The publisher does not need us to vouch for the line that starts their program: they wrote it. Pretending to cover it would make our signature mean less, not more. Every installer shows both answers on its own screen before it changes anything.
02 How our half is proved
Your machine checks it, with no internet
Installing Python 3.14 on 64-bit Linux is the same job whichever app needs it. So we sign each runtime setup once, before anyone asks, and every installer carries a small receipt for the ones it uses.
No network. No server, nothing to ask anybody.
Small and quick. About half a kilobyte, checked in about a tenth of a second.
Never expires. A newer release does not invalidate an installer you already have.
Tamper-evident. Change one byte of a runtime setup and the receipt stops matching.
This is why an installer built entirely inside your browser can still show that what it installs came from us. The browser never holds a secret key: it only carries signatures, it never makes them.
03 Where this page comes from
Online, or a copy saved to disk
Online, with our server
You trust
The site you are on. When the page and its server are the same site, that is one decision, not two, and the header says Server: this site.
How current
Up to date. The server can be asked at install time whether anything has been withdrawn.
Saved to disk, no server
You trust
The copy you saved, and wherever you got it from.
How current
As of the day it was saved, and it says so. Installers it builds state that anything withdrawn since is not known.
Either way, our half is proved the same way: on your machine, with no network.
04 Check it yourself
Our key, and what this copy carries
Not a description: the documents inside the file you are reading, checked against its own key as the page loaded.
Scripting is off, so nothing has been checked here. The key and the signed documents are still inside this file: turn scripting on to see them checked.
TiddlyInstall signing key · Ed25519
Fingerprint
Public key
One key signs everything below. It is public and already inside every installer this page builds. Compare it with the one shown by a copy of this page you already trust.
Signed by this key, carried in this page
Anything that does not check out is marked as failing and is not used. A signed list we cannot verify counts for nothing.
05 The limits
What we cannot prove to you
Said plainly, because a page about trust that lists only its strengths is an advertisement. Each limit comes with what you can do about it.
We cannot proveWhat you can do instead
That the program is safe. We did not write it and have not read it.
Install it because you trust whoever published it. Their signature on the installer file is what names them.
That this page is genuine. A page cannot vouch for itself.
Drop this copy on the Verify page of a copy you already trust. It says whether the two agree.
That this key is ours rather than someone else's. Two copies agreeing tells you they were built from the same key, not whose it is.
Check the fingerprint against somewhere we do not control: the repository, the release ledger, or a copy you got by another route.
That an unsigned installer file was not changed.
Compare its SHA-256 with the one shown where you downloaded it. That check happens outside the file, which is what makes it worth anything.
That a saved copy knows what was withdrawn since.
Use the page online, or save a fresh copy. A saved copy always says how old its lists are.
That we have not rewritten our own history. We hold the key, so a signature alone could not catch it.
Every copy of this page carries a fingerprint of our published record as of the day it was built. Copies in other people's hands can catch a rewrite, and the Verify page compares them.