
Product
Socket Brings Supply Chain Security to skills.sh
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.
bare-build
Advanced tools
Application builder for Bare that allows developers to package their JavaScript code as either native application bundles or standalone executables for both desktop and mobile.
npm i [-g] bare-build
const build = require('bare-build')
for await (const resource of build('/path/to/app.js', {
base: '/path/to/',
target: ['darwin-arm64', 'darwin-x64'],
icon: 'icon.icns',
identifier: 'com.example.App'
})) {
console.log(resource)
}
bare-build \
--target darwin-arm64 --target darwin-x64 \
--icon icon.icns \
--identifier com.example.App \
app.js
| Platform | Unpackaged | --package | --standalone |
|---|---|---|---|
| Linux | .AppDir, Snap compatible | .AppImage | ELF executable with self-extracting .so libraries |
| Android | .apk | .aab | ELF executable with self-extracting .so libraries |
| macOS | .app | .pkg | Mach-O executable with self-extracting .framework libraries |
| iOS | .app | .pkg | Mach-O executable with self-extracting .framework libraries |
| Windows | Plain directory | .msix | PE executable with self-extracting .dll libraries |
for await (const resource of build(entry[, preflight][, options]))Options include:
options = {
name: pkg.name,
version: pkg.version,
author: pkg.author,
description: pkg.description,
icon,
identifier,
manifest,
resources,
base: '.',
target: [],
out: '.',
runtime,
standalone: false,
package: false,
sign: false,
// Apple signing options
identity: 'Apple Development',
applicationIdentity: identity,
installerIdentity: identity,
keychain,
entitlements,
hardenedRuntime: false,
// Windows signing options
subject,
subjectName,
thumbprint,
// Linux signing options
key,
// Android signing options
keystore,
keystoreKey,
keystorePassword
}
bare-build [flags] <entry>Flags include:
--version|-v Print the current version
--name|-n <name> The application name
--author <name> The name of the application author
--description <text> The description of the application
--icon|-i <path> The application icon
--identifier <id> The unique application identifier
--manifest <path> The platform specific application manifest
--resources <path> The platform specific application resources
--base <path> The base path of the application (default: .)
--target|-t <host> The host to target
--out|-o <dir> The output directory
--runtime <specifier> The runtime to use
--standalone Build a standalone executable
--package Package the application for distribution
--sign Sign the application
--identity <id> The macOS signing identity
--application-identity <id> The macOS application signing identity
--installer-identity <id> The macOS installer signing identity
--keychain <name> The macOS signing keychain
--entitlements <path> The macOS signing entitlements
--hardened-runtime Enable the macOS hardened runtime
--subject <id> The Windows signing subject
--subject-name <name> The Windows signing subject friendly name
--thumbprint <sha1> The Windows signing subject thumbprint
--key <hash> The GPG signing key
--keystore <path> The Java-based keystore file
--keystore-key <name> The name of the certificate to use from the keystore
--keystore-password <password> The password to the keystore file
--help|-h Show help
Apache-2.0
FAQs
Application builder for Bare
The npm package bare-build receives a total of 288 weekly downloads. As such, bare-build popularity was classified as not popular.
We found that bare-build demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.

Product
Socket now supports PHP with full Composer and Packagist integration, enabling developers to search packages, generate SBOMs, and protect their PHP dependencies from supply chain threats.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.