// HACKER NEWS — CYBERSECURITY
TiddlyInstall: A universal, reusable, install system
No freezing and no bundlers that break. We install your project's real
runtime and dependencies into a folder of its own, then install your
project against them. Windows installers are built with NSIS, and on
Linux and macOS the installer is one POSIX shell script
with no framework to install.
Every file the installer names is checked against a checksum in it, and refused if it differs. The last two are not among them: the source archive is identified by its commit and fetched over HTTPS, and what pip fetches is decided while you install.
TiddlyInstall is a single HTML file. This page carries the installer
programs, the runtime catalogue, and all the code that makes, edits and signs them.
Give us a GitHub repository and a branch, tag or commit. We clone the actual source code.
At install time it picks the newest runtime that matches your version range and runs
on that computer, then installs it into the app's own folder.
An ordinary .exe for Windows, built with NSIS, plus a .run
for Linux and a .zip for macOS - three real installers.
Each app gets its own copy of every dependency, in folders with short hashed
names. Nothing is shared, so one app can never break another, and uninstalling just deletes the
app's folders. Disk space is cheap; broken installs are not.
Pick Python, JavaScript (Node.js) or Ruby and a template - a script, a window
app, a web page in a window or a tray app - then write your code in the browser, run it, and make
an installer from it with the same pipeline, on the New installer page.
We wrote one installer program - the base installer - and
every installer built here is that same program plus your settings. For example,
install_python_x.exe is that program, with settings that say "install the Python
package x". The code is identical in every copy and only the settings change, which
is why the program itself only has to be tested, hardened and signed once rather than once per app.
A signature here is on the installer program - the one
we wrote, identical in every copy - and never on the software it installs. It works like
the signature on a web browser: it says who wrote the browser and that this copy is
unmodified, and nothing about the sites you visit. The program that asks for your trust at
install time is ours and unaltered, so the screen it shows you can be believed.