baar

OpenInstall

Windows installs without the mystery installer ritual.

OpenInstall turns app distribution into a package-manager flow: resolve the package, verify the publisher and file hashes, show the user what will happen, and install only after explicit consent.

Windows 10/11 Native .oip packages AGPL-3.0
View source Downloads

Flow

A package install should be boring in the best possible way.

01

Resolve

Open an `openinstall://` link or choose an app from a repository.

02

Verify

Check signatures, publisher identity, file hashes, paths, and policy.

03

Consent

Show the user source, trust state, install mode, and package metadata.

04

Install

Copy verified files per-user and write shortcuts/uninstall metadata.

Project details

Built as a verifier and installer, not a wrapper for unknown setup programs.

Install model

Per-user by default

Normal apps install without UAC under %LOCALAPPDATA%\OpenInstall\Apps\<bundle-id>\<version>\. OpenInstall creates Start Menu shortcuts and HKCU uninstall metadata.

Trust model

Signatures, hashes, and publisher pins

Packages declare every installed file and SHA-256 hash. The publisher signature, app identity, file list, permissions, and publisher-key pin are checked before the consent dialog appears.

Distribution

Static HTTPS repositories

A repository is a simple HTTPS directory with a repo.json catalog. Repos are discovery metadata only; every selected package is still verified independently.

Safety boundary

No installer roulette

v1 blocks arbitrary setup executables, scripts, services, drivers, registry payloads, shell extensions, and silent installs as the install mechanism.

Native .oip

Designed around manifests, hashes, signatures, and policy.

OpenInstall packages are not wrapper scripts for unknown setup binaries. They are native archives with explicit metadata, declared files, publisher signatures, and hashes for every installed file. 

example-1.0.0.oip
|-- manifest.json
|-- files/
|   |-- Example.exe
|   `-- assets/
|-- signatures/
|   `-- publisher.ed25519.sig
|-- sbom.spdx.json
`-- provenance.json

Architecture

Small parts with clear responsibilities.

oip-core Pure manifest, signature, hash, and trust evaluation logic.
oip-client Repository resolution, download, validation, blocklists, and install orchestration.
oip-pack Native package authoring, publisher key generation, and manifest signing.
Tauri + Svelte Windows shell, deep links, MSI packaging, launchpad, store, and consent UI.

No silent path

Resolving a link cannot install. Installation needs an explicit click.

No setup.exe roulette

v1 rejects installer and script payloads as the install mechanism.

No OS bypass claim

OpenInstall does not disable Windows security controls or AV policy.

Status

Pre-1.0, open source, and intentionally conservative.

The native package direction and security model are the core design. Package-authoring tools, repository tooling, and Windows signing are still evolving. Public releases are preview builds until code signing is enabled.