Publishing
Sign a bundle and sideload it today, and where third-party publishing stands.
A .zeph-app is a ZIP: a manifest.json, your device.wasm, and a detached signature over it. That signature binds the code, the capabilities, and the version together — change the bytes, re-label the version, or widen the caps after signing, and verification fails. A bundle cannot be quietly escalated once it is signed.
There is no third-party publishing path today. The route that works right now is signing a bundle yourself and installing it onto your own device.
Sign and sideload a bundle
Make a signing key
zeph app keygen dev.key writes a hex ed25519 seed to dev.key and its public key to dev.key.pub. The seed signs your bundles; the pubkey is what the device and companion pin to accept them. Keep the seed secret.
Bundle and sign
zeph app bundle device.wasm --id my_app --version 1.0.0 --caps 0xB --key dev.key -o my_app.zeph-app zips the manifest, the wasm, and the signature into one file. Pass --manifest app.json to author glances, config schema, widgets, and faces the scalar flags can't reach. Add --companion companion.wasm to ship a hosted app — a second part, dual-signed.
Verify before you ship
zeph app inspect my_app.zeph-app prints the manifest and verifies the device part against the pinned key. If the signature doesn't match the wasm, caps, and version, it says so here rather than on the device.
Install onto a device
zeph app install --file my_app.zeph-app installs through the companion onto the connected device. The companion is the control plane: it verifies the signature and installs the app with exactly the capabilities its signature binds — no more.
Bump the version for every release
The signature binds the semver you declared with --version, and the device will not install a strictly older version over a newer one. Bump the version for every release so a re-install is never ambiguous with what is already on the device.
The public path is coming. When third-party publishing opens, apps will resolve from a catalog by id and install signature-verified against a production publisher key — the same signing model, with a key that isn't the committed dev key.