Your Node app, one signed file.

Shipping your app: four steps

In this order. Each one is a command, and the same files always make the same archive, so anyone can rebuild yours and compare.

1. 1 Observe

   Run your app once, the way it is normally used, and write down every file it reads. Dynamic require, data files and conditional imports are exactly what static analysis misses, and exactly what a run reads.

   BUNDLE_MANIFEST=app.manifest node --experimental-vfs -r @pipobscure/bundle/record --vfs-load=./app -- <args>

2. 2 Create

   Archive exactly those files. --launcher puts a short shell script in front so it runs by name; it is decided here, so the review sees it.

   bundle create --base ./app --files app.manifest --launcher --output app.unsigned.nzip

3. 3 Audit

   Review it, against your last release if there is one. Read it yourself and approve it, or let the audit skill that bundle skill installs for Claude Code read every file. bundle audit --check refuses to go on without a clean verdict over exactly these bytes.

   bundle audit --baseline last-release.nzip app.unsigned.nzip

4. 4 Sign

   Only once the review came back clean. Signing uses sigstore by default: your CI's identity, or a browser sign-in. Your own certificate authority works too.

   bundle audit --check app.unsigned.nzip && bundle sign app.unsigned.nzip   # -> app.nzip

The result is a file you run by name, or a plain archive to mount. With bundle sea it is a standalone executable with Node inside, which checks its own signature before it runs anything. bundle itself ships this way: its release workflow tests, audits, signs with the workflow's own identity, and publishes, with no secrets.

Who vouches for this file?

On the Atmosphere

Attestations, listings and suites are records in people's own Atmosphere (atproto) accounts, with any provider. Everyone writes only to their own account: the publisher says where the file is, a curator says what goes together, and an auditor, a scanner or your IT department says what they think of it. You hold the policy that decides whose word counts.

• No registry to run, and nothing in the middle to compromise. An open backlink index only says whom to ask; every record is fetched from its owner and checked against their key.
• Publish under your handle. A listing points at your release URL, such as a GitHub release, and a new version is just a new release. People bundle search for it and install it by name.
• Attestations are checked offline, from a cache that bundle trust keeps fresh.

bundle publish --as you.example --description 'what it does' tool https://github.com/you/tool/releases/latest/download/tool.nzip
bundle attest --as you.example --kind audited app.nzip

You do not need an account to use bundle. Install by URL or domain, sign with sigstore or your own CA. Accounts are only for publishing names and attestations.

What this is not

• Not stable yet. It needs Node 26.11.1 or later with --experimental-vfs, and both sides are experimental.
• Not a sandbox. Checked code runs with full access to your machine, like any Node program.
• Not proof of safety. A signature says who built it, not that it is harmless. That is what review and attestations are for.
• Not checked when run by name. Use bundle run or a standalone executable when you want the check every time.