A lightweight, portable package format and toolkit for the web.
PlutoPack is a package format designed to bundle web applications, games, assets, and related resources into a single portable package.
It is being developed as part of the Plutonium-Net ecosystem.
- Single-file packaging — Bundle an entire project into one
.plutopackfile. - Web-focused — Designed with HTML, CSS, JavaScript, and web assets in mind.
- Binary asset support — Images, audio, video, fonts, and other binary files can be packaged.
- Integrity verification — Packages can verify that their contents have not been modified.
- Safe extraction — Designed to prevent unsafe paths and package traversal attacks.
- Manifest-based — Packages contain metadata describing their contents.
- Versioned format — The format can evolve without breaking older implementations.
- Tooling-friendly — Designed to be easy to implement in different languages.
- Cross-platform — The format is not tied to a specific operating system.
A PlutoPack package contains everything needed to distribute a project as a single package.
A package may contain:
game.plutopack
│
├── manifest
├── index.html
├── css/
├── js/
├── assets/
└── ...
The exact internal structure is defined by the PlutoPack specification.
A typical project might look like:
my-game/
├── index.html
├── css/
│ └── style.css
├── js/
│ └── game.js
└── assets/
├── player.png
└── music.mp3
PlutoPack can turn the project into:
my-game.plutopack
The package can then be distributed as a single file rather than requiring the entire project directory to be transferred separately.
The PlutoPack ecosystem is intended to provide tools such as:
plutopack pack ./my-game
plutopack unpack my-game.plutopack
plutopack inspect my-game.plutopack
plutopack validate my-game.plutopackCreates a PlutoPack package from a directory.
plutopack pack ./my-gameExtracts a PlutoPack package.
plutopack unpack my-game.plutopackDisplays package metadata and contents.
plutopack inspect my-game.plutopackChecks a package for structural and security issues.
plutopack validate my-game.plutopackTooling is under active development and commands may change before the first stable release.
Every PlutoPack package contains a manifest describing the package.
A simplified example:
{
"plutopack": "1.0",
"name": "Example Game",
"version": "1.0.0",
"entry": "index.html",
"files": []
}The manifest provides implementations with the information required to understand and process a package.
PlutoPack supports file integrity information so implementations can verify package contents.
A package may contain information similar to:
{
"path": "js/game.js",
"size": 182394,
"sha256": "..."
}This allows applications to detect unexpected modifications or corrupted files.
Security is a core part of the PlutoPack design.
Implementations should protect against issues such as:
- Path traversal
- Malformed manifests
- Duplicate file paths
- Invalid file metadata
- Unexpected file sizes
- Corrupted package data
- Malicious package contents
Do not assume that a PlutoPack package is trustworthy simply because it is a valid package.
A valid package can still contain malicious HTML, JavaScript, or other content.
PlutoPack is intended to be implementation-independent.
The format may eventually have implementations for:
- JavaScript
- TypeScript
- C++
- Rust
- Python
- Other languages
An implementation does not need to use the official PlutoPack tooling as long as it follows the PlutoPack specification.
| Document | Description |
|---|---|
| Specification | Complete PlutoPack format specification |
| License | PlutoPack licensing terms |
| Contributing | Contribution guidelines |
| Addition | How To Add To Website |
Documentation will expand as the format develops.
Contributions, suggestions, bug reports, and improvements are welcome.
Before contributing, please read the project's contribution guidelines and ensure that your contributions comply with the Plutonium License.
PlutoPack is developed as part of Plutonium-Net, an organization focused on building software, tools, and experimental technologies.
Organization: Plutonium-Net
PlutoPack is distributed under the Plutonium License (PL) v1.0.
See LICENSE for the complete license text.
