Flavorpack
Ship any Python application as a single, self-contained executable.
Native launcher. Cryptographic signing. No runtime required.
Flavorpack packages Python applications into .psp executables — single files that the OS runs directly. No Python installation required. No virtual environments. No dependency conflicts.
Each package bundles a native launcher (Go or Rust), the Python runtime, your application code, and all dependencies. The launcher extracts and runs everything transparently, with intelligent caching so subsequent runs skip the extraction step entirely.
The format is language-agnostic. A single package can contain Python code, compiled native binaries, data files, and assets — whatever your application needs.
PSPF 2025 is a polyglot binary — simultaneously a native OS executable and a structured data archive. The same file that runs on Linux runs on macOS.
Each slot is a 64-byte descriptor specifying type, encoding, offset, size, lifecycle, permissions, and platform requirements. Up to 8 chained operations per slot allow transformation pipelines (e.g. tar → gzip).
Every .psp package embeds a native launcher — compiled Go or Rust — that runs at OS speed before any Python code starts. The launcher owns the full execution lifecycle.
~1 MB. Optimised for size and memory efficiency. The smallest possible footprint without sacrificing correctness. Preferred for production packages.
~3–4 MB. Broader platform compatibility and faster compile times during development. Functionally identical to the Rust launcher.
FLAVOR_* environment variables, configure the Python path, and exec the entry point. Returns the app's exit code.Extracting a 40 MB Python runtime on every invocation would be unusable. The workenv solves this: slots are extracted once to ~/.cache/flavor/workenv/{id} and reused across runs. Checksums verify integrity on each startup.
When you update a package, the ID changes and a fresh workenv is created. Old workenvs can be pruned with flavor workenv clean.
flavor workenv list
# Show cache statistics
flavor workenv info
# Remove a specific package's cache
flavor workenv remove terraform-provider-mycloud
# Clean everything older than 30 days
flavor workenv clean --older-than 30d
Cryptographic signing is not an option — it's the default. Every package includes an Ed25519 signature verified by the launcher before any code executes.
Ed25519 Signing
Every package is signed automatically at build time. The public key is embedded in the index block; the launcher verifies before extraction.
Multi-level Checksums
CRC32 on the index block. SHA-256 on metadata, each slot, and extracted files. Tampering at any layer is detected.
SBOM Attestation
Embed a CycloneDX 1.6 Software Bill of Materials. Inspectable with flavor inspect --sbom for supply chain transparency.
Deterministic Builds
Use --key-seed to generate identical packages across CI builds — same binary, same signature, fully reproducible.
Execution Policies
System and user policy files (/etc/flavor/policy.toml) enforce constraints: require signatures, block running as root, mandate SBOM.
Path Isolation
All extraction paths are sanitized. Slot contents cannot traverse outside their designated workenv directory.
CLI Tools
Distribute command-line utilities without requiring users to install Python, pip, or manage virtual environments.
Terraform Providers
Package pyvider providers as single executables compatible with Terraform's plugin protocol. The primary use case for the pyvider ecosystem.
ML & Data Apps
Bundle Python runtime, model weights, and inference code into a single portable artifact. Eliminates "works on my machine" entirely.
Enterprise Distribution
Sign packages with your organisation's keys. Enforce policies at the OS level. Distribute with cryptographic provenance.
DevOps Tooling
Deployment scripts, configuration managers, monitoring agents — ship as single files with no runtime dependency.
Polyglot Applications
Mix Python code, compiled native binaries, and data files in one package. The slot system handles each component independently.
1. Configure your manifest
name = "my-tool"
version = "1.0.0"
dependencies = ["mypackage>=1.0"]
[tool.flavor]
type = "cli"
[tool.flavor.execution]
command = "{workenv}/bin/python"
args = ["-m", "mypackage.cli"]
2. Pack and run
uv tool install flavorpack
# Package your application
flavor pack --manifest pyproject.toml \
--output my-tool.psp
# Inspect the package
flavor inspect my-tool.psp
# Run it directly — no Python needed
./my-tool.psp --help
Build for any supported platform without a matching machine. Linux builds use static musl linking — no glibc version requirements.
for platform in linux_amd64 linux_arm64 darwin_arm64 darwin_amd64; do
flavor pack --platform $platform --output my-tool_$platform.psp
done
Other tools try to compile Python away. Flavorpack bundles it — intact, cached, and fast.
Full documentation, guides, and the PSPF format specification.