Installor

Your software catalog, detection, acquisition, and installation workflow—portable across machines.

Download · Website · User guide · Architecture · Research prospectus

Installor is a local-first desktop application for people who repeatedly configure computers and want one trustworthy place to record, detect, download, verify, and install software. A catalog can be maintained locally, imported from a publicly shared Google Sheet owned by any Google account, or synchronized through an optional self-deployed Apps Script bridge.

No Google Cloud project, OAuth client, API key, or account connection is required for public-link imports.

Why Installor

Portable catalog Keep software names, sources, platform targets, installer types, checksums, tags, and notes in one structured library.	Human-controlled automation Detection and file matching produce reviewable suggestions. Installation begins only after an explicit selection and confirmation.	Account-independent sharing Import a correctly structured public Google Sheet regardless of who owns it, without connecting the owner's Google account.
Native acquisition Use winget, Homebrew, APT, DNF, Pacman, Flatpak, or a direct installer URL.	Integrity-aware downloads Stream files with progress and validate SHA-256 checksums when supplied.	Local-first privacy Catalog state stays in a per-user SQLite database; bridge secrets use the operating-system credential vault.

Install and start

Windows—the verified v0.2.0 path

1. Open the latest release.
2. Download Installor_0.2.0_x64-setup.exe for the guided installer, or the .msi package for managed deployment.
3. Run the installer and open Installor from the Start menu.
4. An unsigned community build may trigger Microsoft SmartScreen. Review the publisher and release checksum before choosing to continue.

The standalone installor.exe is also attached to the release for portable evaluation. It does not provide Start-menu integration or an uninstaller.

macOS and Linux

The codebase, detector implementations, installer plans, platform icons, and GitHub build matrix support macOS and Linux. Native packages are produced by the tagged-release workflow. Because v0.2.0 was manually exercised on Windows, treat other platform packages as evaluation builds until the corresponding checks in the manual QA matrix are completed.

Platform	Detection	Installation routes	v0.2.0 status
Windows	Registry uninstall entries	winget, MSI, Inno Setup, NSIS, interactive installers	Locally built and tested
macOS	system_profiler	Homebrew, PKG, DMG, interactive installers	CI/package configuration ready
Linux	dpkg, rpm, pacman, Flatpak, Snap discovery	APT, DNF, Pacman, Flatpak, DEB, RPM, AppImage	CI/package configuration ready

Use Installor

1. Build your catalog locally

Open Catalog → Add software and provide at least a name. For a package-manager entry, select the source and enter its package ID. For a custom installer, supply a trusted HTTPS download URL or place the installer in the configured download folder. Add a 64-character SHA-256 checksum whenever the publisher provides one.

2. Review software already on the computer

Open Detected software → Scan this computer. Installor filters platform records into a review list. Use the row checkboxes, Select visible, Add selected to catalog, or Add all to approve records in bulk. Adding records stores both the portable catalog entry and this computer's installation details; scanning alone changes nothing.

3. Import a public Google Sheet from any account

1. Copy the Catalog template into a tab named Catalog.
2. In Google Sheets select Share → General access → Anyone with the link → Viewer.
3. Copy the normal Share URL.
4. In Installor open Settings → Public Google Sheet, paste the URL, and select Import shared Sheet.

The only required column is name; using the complete template preserves installation metadata. An optional Installations tab can follow this template. Public-link mode is intentionally read-only—Installor downloads CSV data exposed by Google and never receives Google account credentials.

4. Download and install

Select catalog rows, then choose Download selected. Installor reports progress and checks configured SHA-256 values. A mismatch is reported and should be investigated; do not install a file whose checksum differs from the trusted publisher value. Choose Install selected, review the confirmation, and approve any legitimate operating-system elevation prompt. Installor executes selections sequentially to avoid package-manager lock conflicts.

5. Find an installer already on disk

Set the download folder under Settings, then choose Find installers. Installor ranks filenames against catalog names and shows only suggestions above its confidence threshold. Confirm a suggestion only after checking that the file came from a trusted source.

6. Share a named device's catalog with another device

Public Google Sheets cannot accept anonymous edits, so upload and cross-device synchronization use the guided, owner-deployed bridge:

1. On the source device, give it a clear name such as Office Desktop, then open Settings → Set up Google synchronization.
2. Follow the five in-app steps. Installor generates the private shared secret, shows the complete version-matched Apps Script, and copies it with one button.
3. Paste and deploy the script from the target Sheet, paste its /exec URL back into Installor, then choose Save and test connection.
4. Choose Push entire local library. This includes catalog and installation records added before synchronization was configured.
5. On another device, install Installor, assign its own name such as Research Laptop, use the same guided script and deployment URL/secret, and choose Sync with Sheet.

The receiving device gets the portable catalog and displays precise categories such as Office Desktop and Research Laptop. Sync with Sheet downloads newer remote records, uploads pending local changes and removals, and reports exactly what moved. It never scans, downloads, installs, uninstalls, or deletes files. The secret is stored through Windows Credential Manager, macOS Keychain, or Linux Secret Service—not in SQLite. See the complete write-back guide.

7. Remove catalog records safely

Select one or more catalog rows and choose Remove selected. This removes Installor catalog metadata and its linked installation records; it does not uninstall applications or delete installer files. When synchronization is configured, the removal is queued and propagated to other connected computers on the next sync.

For field definitions, operational examples, troubleshooting, and safe-uninstall guidance, read the complete User Guide.

Architecture and reproducibility

Interface Accessible HTML/CSS and vanilla JavaScript ES modules.

Desktop core Tauri v2 and Rust 2024 commands, typed models, and explicit process arguments.

Local state SQLite catalog, installations, settings, and retry queue.

Optional exchange Anonymous public-Sheet import or owner-deployed Apps Script write-back.

Development prerequisites are Node.js 20+, a stable Rust toolchain, and the Tauri v2 platform prerequisites.

npm ci
npm test
cargo fmt --manifest-path src-tauri/Cargo.toml --all -- --check
cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
cargo test --manifest-path src-tauri/Cargo.toml
npm run dev

Create native packages for the current operating system with npm run build. See Architecture, product documentation, and the implementation runbook for the complete design record.

Security and privacy posture

• Installor does not bypass SmartScreen, Gatekeeper, package-manager policy, or operating-system elevation.
• URLs and installer files remain the user's responsibility; prefer official publishers and HTTPS.
• Optional checksums detect file differences but do not prove publisher identity by themselves.
• Local catalog data is not automatically uploaded. Sync occurs only when configured.
• Do not publish exported institutional records, private software inventories, secrets, or local database files in issues.

Report vulnerabilities privately according to SECURITY.md. Use expectations and prohibited-use guidance are documented in RESPONSIBLE_USE.md.

Research and industry collaboration

Installor is an inspectable foundation for research into dependable software acquisition, provenance-aware automation, human-in-the-loop systems administration, cross-platform state reconciliation, and usable security. The repository intentionally separates verified behavior from planned work and contains reproducible tests, architectural documentation, and a scoped roadmap.

Potential collaborations include empirical studies of installer provenance, secure catalog exchange, enterprise policy layers, software-supply-chain metadata, and human factors in automated deployment. See the Industrial PhD and Research Collaboration Prospectus and Funding for concrete directions and engagement routes. No funding, institutional endorsement, or production-security certification is implied by this repository.

Project governance

Contributing	Code of Conduct	Support	Governance
Roadmap	Changelog	Security	Citation metadata

Citation

If Installor supports academic work, cite the software using the repository's Cite this repository control or the metadata in CITATION.cff:

Sudipta Kumar (2026). Installor (Version 0.2.0) [Computer software].
https://github.com/the-sudipta/installor

License

Copyright © 2026 Sudipta Kumar and contributors. Installor is licensed under the Apache License 2.0. Third-party components remain subject to their respective licenses.

Private by default · portable by design · explicit by operation