Zapstore

Open, permissionless app store powered by your social graph

Download 0.2.5 for Android: https://cdn.zapstore.dev/bd5c21e3c37702de81c40d8425f8754d8739476ddd2daeba147e9e96eeb0e397

SHA-256 checksum: bd5c21e3c37702de81c40d8425f8754d8739476ddd2daeba147e9e96eeb0e397

APK cert hash (for AppVerifier): 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Public Key

npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8

NIP-05 Address

_@zapstore.dev

NIP-57 Address

zapstore@getalby.com

Profile Code

nprofile1qqs83nn04fezvsu89p8xg7axjwye2u67errat3dx2um725fs7qnrqlgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduq3vamnwvaz7tmjv4kxz7fwdehhxarj9e3xzmnynln22z

Publishing to

relay.damus.io

relay.nostr.band

relay.primal.net

Author Public Key

npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8

Show more details

Last Notes

2025-03-11 17:33:54

Huge thank you to @nprofile…uazd for approving my grant for Zapstore!
Excited for the year ahead!

2025-03-10 16:37:07

- reply

Yeah we'll build great stuff. But it will take longer than April amigo.
However I want to see whats available now. Which one is a NIP-72 client? Just to check it out

2025-03-10 16:25:53

- reply

I do not like Discord style interfaces. Too gen z for me.
Amethyst where? All I see is feeds. Feeds everywhere.

2025-03-07 20:07:43

Managed to get silent updates running 🤩
While I generated 99% of the code with an LLM and it kinda worked out of the box (impressive), silent updates still did not.
But the absolute legend of @nprofile…vdel helped me out and sent a PR with a few changes, and now it works! Zap him if you can.
Still in development phase, but coming soon! I need to make it opt-in, and with the ability to prevent some apps from auto updating.
#nevent1q…k40s

2025-03-07 18:01:03

About automatic silent app updates:
Which OSS app store has them? In theory I see Obtainium and Accrescent do.
However with Obtainium I've always been prompted to Update. Sure, updates were downloaded in the background but user action was required.
Can't speak for Accrescent as I have not used it.
Also, in several code tests I could not make it work despite having the right permissions (UPDATE_PACKAGES_WITHOUT_USER_ACTION) and being Android 12+.
I would appreciate feedback on this issue as I'm not even sure it's possible.

2025-02-25 21:13:16

- reply

*I meant updating without user action, via the permission. Not installing

2025-02-25 21:03:54

- reply

I still feel it's a bit of shooting in the dark. I just spent 3 hours with Claude and it produced some random shit, when a line doesn't work it rewrites 30% of the previous code "sorry I made a mistake". There's little coherence and so far it does not seem like the right approach (because I don't understand Kotlin well, so can't modify)

2025-02-25 20:48:53

- reply

Thanks. Afaik replit does not do native apps or does it?

2025-02-25 20:47:51

- reply

Blitz is probably because the dev started signing on Zapstore and you had the previous one. Reinstalling will fix it.
For Obsidian, they manipulated the release files after indexing. Need to wait til the next release

2025-02-21 23:36:23

- reply

Oh you mentioned Brave.
Just tried, it installed under a minute. Zapstore fetches that one from Github so it's something between you and Github servers.
File is huge (262mb) so if you have an older device it might take longer as its also hashing the file for verification.

2025-02-21 20:21:11

- reply

First off thank you for the time you took to write this, I sense you genuinely like the project and want it to succeed.
Agree with 95% of what you listed, as a matter of fact these are things that I already want to do. Most are documented in Github issues. So I appreciate your free consultation, Sir, the main constraint is I'm running a solo show with zero funding other than a few zaps - not a startup with 12 employees.
Priorities matter, and for my target niche audience (nostr enthusiasts, first stage) trust is established via other means. It would be foolish to focus a minute of my time on the blog, even though I would like to see that looking better.
Normies are not the target audience at this moment.

2025-02-21 19:17:27

- reply

Which one?

2025-02-21 16:56:16

- reply

Not yet

2025-02-21 16:51:19

Starting work on automatic silent updates.
Not easy, as most installer plugins fall short, so I have no idea when it will be ready. But I'm on it, as I definitely want it.
If anyone is good at Kotlin/Flutter plugin code and would like to contribute, let me know!

2025-02-19 15:44:13

🚀 Zapstore 0.2.5: bugfix of the bugfix
- Hopefully fixed the missing apps issue
- No more toast showing Zapstore update available (pinned instead)
- Trigger local version refresh on app detail page
Try it out, fingers crossed 🤞

2025-02-18 23:08:33

- reply

Yes. Even though most people had no issues, some did

2025-02-18 18:59:22

Do not update unless you have to.
Strange things happening. Fuck. Looking into it.

2025-02-17 13:32:45

- reply

Cancelaste la instalacion?
Si no, es dificil saber que pasa. Reinstalar es la unica lamentablemente.

2025-02-17 13:25:04

GM!
There is an error parsing some app versions. I will be fixing it today.
If you really need to upgrade one of those apps, though not ideal, reinstalling will work.

2025-02-14 17:14:59

- reply

Sure. Please talk to the dev @nprofile…nq7m

2025-02-14 15:52:56

- reply

Sorry but what should I do?

2025-02-13 17:20:44

- reply

Sure, what's the Android app ID?

2025-02-13 14:42:04

- reply

Yes, because there is a hash mismatch. I can't do anything about it. I think they fixed it.

2025-02-11 02:35:06

- reply

We're talking about the same thing man, no disagreement. You still need information on provenance when first installing, and the nostr web of trust plus verification is a way of doing that (as opposed to a centralized curator)

2025-02-10 22:43:36

- reply

@nprofile…k38f your APK likely had an issue uploading to our server, so no one can update or install.
Do you mind re-publishing the package? You can add the --overwrite-release flag to the command you already use to publish. Make sure the upload succeeds. Thanks!

2025-02-10 21:20:34

- reply

Android does not handle trust on first use, as it allows you to install APKs from any source.
This is what I meant for signatures: https://github.com/nostr-protocol/nips/pull/1335

2025-02-10 19:32:19

- reply

I am certainly not asking for permission, these APKs are indexed.
APK certificates are outside the nostr ecosystem (unless we use my proposed linked cryptographic identities PR, which I'll add to zapstore-cli) so that doesn't help with the TOFU issue and web of trust.

2025-02-10 15:37:47

Some apps with nostr accounts that do not self publish:
Primal, Minibits, eNuts, Fountain, Aqua Wallet, Nostrmo, Fedi, Voyage, Wavlake, BTC Map, Simplex Chat, Nunchuk Wallet, IVPN
Are you okay with those being indexed/signed by Zapstore?
Would you prefer them to be signed and published by their developers?
If so, poke them to do it! I am happy to guide them through the process
(Bonus: self published apps can be zapped!)
#devstr

2025-02-10 14:30:43

- reply

Done!

2025-02-10 14:12:18

- reply

What Zapstore version are you on?

2025-02-09 21:58:19

- reply

Coming soon! It's high on the list

2025-02-08 15:39:12

- reply

Yes, just that it's not a priority yet

2025-02-07 22:04:02

- reply

You trust the developer on this.
A planned feature is the reproducible builds DVM, where different vendors can vouch for a specific hash when building from source. It would appear like checks or badges in the UI.

2025-02-07 22:01:53

- reply

No, we do not compile anything. Packages come straight from the source (mostly Github)

2025-02-07 20:21:59

Finally, our favorite app is on @nprofile…tdq0 🌈
https://image.nostr.build/3af3145dac7bfdd59ce29a35b1bcb0763af7f762e21b3aaf5e64ee55f726ac18.jpg

2025-02-06 19:54:53

- reply

I see what happened, I checked the latest which does not have an APK. All others do. There's another problem, they are all pre-releases (beta) and our indexer does not pick those up.

2025-02-05 14:38:01

- reply

Sorry but it's not there. They have a separate site I think

2025-02-01 16:50:46

- reply

Not at all, they should query a specialized DVM.
Clients are free to do anything they want with those results, share them, keep them for offline usage, etc

2025-02-01 16:32:51

- reply

This seems very complicated. As a left curve individual I want to query a service and get the stuff I want, very fast, and yes that includes personalized Pagerank.
It's up to the service to cache internally if it can't do realtime, no need to generate a massive amount of events.
As a client, I can ofc keep these signed results cached if I want, put them on a relay, whatever. I just don't think this belongs to a spec

2025-02-01 15:35:47

- reply

I need to read NIP-85 in full to give my opinion but exporting this data for every single pubkey permutation seems like a waste of resources.
Thanks but Zapstore is already using Vertex, we need this actionable information in under a second.
Early next week (Tue-Wed probably) I will publish our draft DVM specs and I would love if y'all could chime in. I'll ping you

2025-01-31 22:50:43

We're moved away from the old centralized API for web of trust data.
Please make sure you're on the latest Zapstore 0.2.3 or it won't work!

2025-01-31 21:21:12

- reply

Old one is down yes, Vertex on 0.2.3 is up 👀

2025-01-31 16:02:31

- reply

No, I would like to help @nprofile…nq7m self-publish

2025-01-31 15:59:45

- reply

You gave up with Zapstore? 🫤

2025-01-30 19:15:43

We have a bunch of new app additions to our relay!
Thanks for the recommendations @nprofile…vrdk @nprofile…xeh8 and @nprofile…mlw6

2025-01-30 00:43:50

- reply

Oh, look at what @nprofile…crvd is doing

2025-01-30 00:40:33

- reply

Honestly I don't know. Why do I need a system for making decisions? I just make them. Zapstore is not a democracy.
If F-Droid is a dumpster fire and they don't listen, use something else.
The beauty of OSS and open protocols is that anyone is free to fork AND take users data if they don't feel their opinion is being taken into account.

2025-01-29 16:49:04

- reply

Yes! I would appreciate that Braydon. Does that happen in both orientations? What Android is that running?

2025-01-29 16:40:57

- reply

Which governance?
Our goal is to provide tools to remove middlemen or minimize trust in them.

2025-01-29 16:37:46

- reply

Zapstore pulls APKs from different sources, mostly Github. We calculate hashes and when users install an app, they download it from the original location.
We do NOT build and host like F-Droid.
DVMs checking for security and privacy (and reproducible builds) are coming.
The project is run by @nprofile…ucf3

2025-01-29 16:33:41

- reply

I removed it to give way to them to self publish. Did you manage @nprofile…8qzu ?

2025-01-29 16:30:19

- reply

What does this mean?

2025-01-28 01:16:04

It's early days for Zapstore so there are still single points of failure:
1) single hardcoded apps relay
2) few hardcoded social relays (profiles and social notes)
3) single hardcoded web of trust service
The app relay has two different risk profiles:
- for developer-signed apps: censorship risk, just like with any regular nostr relay
- for external apps signed by Zapstore (the ones picked up by our indexer): censorship and man in the middle attack risks.
My goal for the first half of 2025 is to fix or mitigate these issues:
1) offer app relay management, prepare for community-based relays, and another distinct app relay for external apps; as well as working on some additional form of app vouching, either by users or vendors
2) use all social relays with outbox model
3) offer WoT DVM management to choose your preferred provider
In an ideal world, all developers self-sign their apps. To get there we have to keep hustling and make the best product possible, and work hard on our outreach, to entice more and more developers to join.
Just like a better Twitter won't fix social media, no centralized app store, no matter how well intentioned, will be able to fix app distribution at a global scale.

2025-01-28 00:42:59

- reply

We do not build, but you're correct that you need to trust us (to provide the right hashes).
All indexed APKs are fetched from their original location, mostly from Github, this helps somewhat distribute the trust.

2025-01-26 22:59:16

- reply

Thank you. Yes, that is the plan - we need to build a custom relay for that and figure out how to scale updates, not trivial. Adding multiple relays (that have different policies) is required for that and coming too.

2025-01-26 19:05:24

- reply

Can't have it all 😂

2025-01-26 16:17:52

- reply

Probably the stock Android keyboard - GBoard?

2025-01-26 16:12:49

- reply

Long tap on the app icon. Go to App info. Remove Network permission.

2025-01-25 03:38:14

- reply

There are several moving parts to achieve that sort of user experience. All of them are open issues on Github already.
Without Zapstore installed first it gets tricky but I'll do my best

2025-01-25 03:04:36

- reply

Hopefully on Play Store later this year. Not a priority at the moment

2025-01-25 03:03:27

- reply

Yes, really want to make this happen

2025-01-23 14:42:11

- reply

Go to albyhub.com and look for the wallet connections tab, you need to generate a new connection and that will give you the string, it starts with nostr+walletconnect://

2025-01-17 01:28:02

- reply

#nevent1q…7xjt

2025-01-17 01:11:36

- reply

Hello! Where is the APK?

2025-01-16 21:54:58

- reply

Workaround: use a non-KYC card

2025-01-15 22:26:43

- reply

Because Zapstore is spelt all in one word and I liked it more

2025-01-15 21:53:38

- reply

It's one of his accounts. Did you sign in to see who follows that Pablo? It should give you a good idea whether to trust him or not

2025-01-15 21:20:28

0.2.3 is out 🤙

2025-01-15 21:07:34

- reply

Open an issue 🙏

2025-01-15 21:07:22

- reply

Uhmm... no 😂

2025-01-15 17:06:39

- reply

Install won't be an event, and definitely not a public one. However, just as you can see curated app sets today, you will be able to put all your installed ones in an encrypted event like that.
The main issue is backing up data for every one of those apps, that is something beyond Zapstore

2025-01-15 16:42:21

- reply

Nice!
However, unless you need Accrescent for something else, why not verify the Zapstore cert directly? The cert hash is in our profile
Btw that is exactly what AppVerifier does but through a UI

2025-01-15 16:40:35

- reply

We will get update notifications hopefully in Q1 😅

2025-01-15 16:39:42

Thanks Max, this is great to hear!
To address some of the comments: yes, Zapstore is not a full Obtainium replacement for now so they can be complementary.
Managing relays is a priority for this year, and at the same time I started designing a "proxy relay".
Early stages and not an easy task - but the idea is you will be able to add this github-proxy relay and through the usual Zapstore UI find any APK on Github. This approach has important tradeoffs that I'm thinking how to present to the user. (These relays will be signing with their own keys)
And yes, this means we will be opening up for anyone to provide an app relay and easily add it to Zapstore - something that today it's only possible by forking the app.
#nevent1q…r7s8

2025-01-14 17:44:42

- reply

Sorry, I'm confused. When indexing we produce 1063 events we store as nostr events in our relay. We use a database for the relay
When developers upload their APKs to Zapstore, cdn.zapstore.dev acts as a read only Blossom server.

2025-01-14 16:55:52

- reply

Great for closed source apps. Risky for open source apps.

2025-01-14 16:32:43

- reply

Absolutely, I agree with you. However F-Droid is a tricky one. They build AND host packages themselves, and they had security issues. Way too much trust placed in them. The only way that makes sense to use F-Droid is with reproduceable builds.

2025-01-14 16:25:42

- reply

I have removed btcmap from our indexer and deleted all releases, to give way for you to self publish

2025-01-14 16:21:55

- reply

I can help, yes!
I don't know what is going on with apktool there. Do you mind installing it on your own?
https://apktool.org/blog/apktool-2.9.3/
Once that is in your PATH you should be able to publish.

2025-01-14 16:14:30

- reply

And how did you verify that you have the right F-Droid?
People like Zapstore because it does all that stuff for them, too 😉

2025-01-14 16:11:24

- reply

There's two types of packages in Zapstore. The ones we index (Github and other) and self published by developers. Ideal is the latter, but the former is necessary.
So, where the files live depends on the package. I encourage you to query our relay for kind 1063s and check url and x tags.
Indexed locations and hashes are captured at the time we crawled them. Some developers modified releases after the fact and this caused hash mismatch errors - Zapstore working as expected.

2025-01-14 16:00:29

- reply

Isn't it better to go to zapstore.dev rather than trusting yet another domain?

2025-01-14 15:59:36

- reply

Best tradeoff between convenience and security IMO:
Download Zapstore from the link in our nostr profile, to your computer. Go to the terminal and type shasum -a 256 zapstore.apk
The result should match the hash in our nostr profile as well.
From there send the APK to your phone, or repeat the download from your phone itself shortly after - highly likely the file will be the same.

2025-01-14 15:55:21

- reply

It can be as daunting as you want it to be!

2025-01-14 15:54:14

- reply

What is the rationale for preferring F-Droid, if I may ask? It is a third party, whereas via the web you are trusting our domain name and server. You can verify certificate and blob hash if you want to be 100% sure.
Yes, we want to put Zapstore on F-Droid. But we do not want F-Droid to build a non-reproduceable APK, that would be regarded.
When we get to reproduceable builds, we then will go through the F-Droid bureaucracy, no problem.

2025-01-12 22:27:16

- reply

If there is no APK, Obtainium will not help you

2025-01-12 22:25:57

- reply

Yes, then they changed the APK after it was indexed. Zapstore working as expected!

2025-01-12 20:08:00

- reply

Can you try again? If it still fails and the file fully downloaded, it's likely @nprofile…snac modified the github release. Otherwise there is a man in the middle attack - be careful this is a wallet

2025-01-12 20:03:04

- reply

How much time is forever? Sometimes connections are not great and it can take a bit longer. Our relay is not always performant.
Can you kill the app and try again? I just did that and it loaded everything in a few seconds, and I'm on a bad cell connection

2025-01-11 14:28:11

- reply

Have you searched for it?
@nprofile…nrls do you want to self publish and get zapped?

2025-01-08 20:32:43

- reply

👋

2025-01-08 12:56:22

- reply

I can whitelist you on the relay. If everything changed maybe use a new android app ID? Let me know which one it would be, as well.
Check out the docs https://zapstore.dev/docs/cli/publish/

2025-01-08 00:04:45

Zaps are only available for developers who self publish

2025-01-07 23:22:46

- reply

Yeah absolutely, we'll do what possible

2025-01-07 21:54:51

- reply

Apple has an app store monopoly, unfortunately

2025-01-07 21:38:43

- reply

It goes directly to the dev wallet just like any other zap

2025-01-07 21:28:27