I don't know how node-webkit works exactly, but npm uses CouchDB to store the packages definition. If node-webkit works the same (ie you can publish the applica

I don't know how node-webkit works exactly, but npm uses CouchDB to store the packages definition. If node-webkit works the same (ie you can publish the application on the npm registry), you can replicate the registry (or part of it) on other places, and redirect your local node-webkit installer on those replicas. These replicas don't need to be CouchDB instances, they just need to speak its protocol. Fortunately for you there's an excellent package that does that: PouchDB (http://pouchdb.com/ http://pouchdb.com/), which you can use as a library (so you don't need to install another server) in your node.js application. Finally, when the user wants to install the application that is published on the npm registry, it would have to get some kind of signature from the registry, and then pick any mirror to download the content from. This is a very important step: there must be a way for the user to make sure what he downloads is legit. One can assume if it's on the npm registry then it is. This is not bittorrent, but it's much more integrated in the current environment which means less hacking to do.