[dispatch] A packaging format for the web

[Jeffrey Yasskin <[e-mail]>]

Hello Dispatch,

TL;DR: We're bringing the work at https://github.com/WICG/webpackage
to the IETF.

People would like to use content offline and in other situations where
there isn’t a direct connection to the server where the content
originates. However, it's difficult to distribute and verify the
authenticity of applications and content without a connection to the
network. The W3C has addressed running applications offline with
Service Workers (https://www.w3.org/TR/service-workers-1/), but not
the problem of distribution.

* People with expensive or intermittent internet connections are used
to sharing files via P2P links and shared SD cards. They should be
able to install web applications they received this way. Installing a
web application requires a TLS-type guarantee that it came from and
can use data owned by a particular origin.

* Verification of the origin of the content isn't always necessary.
For example, users currently share screenshots and MHTML documents
with their peers, with no guarantee that the shared content is
authentic. However, these formats have low fidelity (screenshots)
and/or aren't interoperable (MHTML). We'd like an interoperable format
that lets both publishers and readers package such content for use in
an untrusted mode.

* CDNs want to re-publish other origins' content so readers can access
it more quickly or more privately. Currently, to attribute that
content to the original origin, they need the full ability to publish
arbitrary content under that origin's name. There should be a way to
let them attribute only the exact content that the original origin
published.

We think a packaging format can help satisfy these use cases. This
format likely also has other uses, and we should try to support such
use cases as long as they don't compromise the offline use cases. For
example, packages may help optimize transferring online content or let
third-parties assert properties of the package via cross-signatures.

The Chromium project has started work on this sort of packaging format
within the W3C's WICG, at https://github.com/WICG/webpackage. We have
a list of use cases, some goals and explicit non-goals, and a draft
for the format itself. We believe the IETF is the ideal place to
standardize the format, and in parallel we'll specify within the W3C
how browsers should load it. I'll be writing an initial internet-draft
in the next couple weeks, in time to bring it to IETF 99.

We'd appreciate being directed to the appropriate place within the
IETF to do this work.

Thanks,
Jeffrey Yasskin

P.S. I'll be on vacation from June 16-23; I'll reply intermittently
during that time but mostly once I get back.