zap.store

The permissionless app store

Download link: https://cdn.zap.store/260579d5bc8b1b53e53116057b85007aa62a52d32e29dece22cf55ce3d129e49.apk

SHA-256 checksum: 260579d5bc8b1b53e53116057b85007aa62a52d32e29dece22cf55ce3d129e49

APK cert hash: 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Public Key

npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8

NIP-05 Address

_@zap.store

NIP-57 Address

zapstore@getalby.com

Profile Code

nprofile1qqs83nn04fezvsu89p8xg7axjwye2u67errat3dx2um725fs7qnrqlgpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgqg5waehxw309aex2mrp0yhxgctdw4eju6t0nu5c0t

Publishing to

relay.primal.net

relay.damus.io

nos.lol

Author Public Key

npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8

Show more details

Last Notes

2024-11-04 17:49:25

zap.store has influencooors, blindly signs apps pulled from Github/Microsoft and has a hardcoded, closed relay.
Frens, I'm not Google Corp with unlimited resources 😂 I'm solo on this stuff (but building fully on nostr) and trying to introduce better UX and bootstrapping in a sustainable way in order not to burn out.
Patience please🙏 Relay management, better security features, and viewing apps through your web of trust lens are all coming.
#nevent1q…lgh2

2024-10-15 01:26:05

- reply

Agreed

2024-10-14 16:22:08

- reply

Your wish is my command 🫡
Search for zmninja now!

2024-10-12 11:49:43

#0xchat signed by @nprofile…f30t LFG 🚀
https://image.nostr.build/fe6bb7198da3dfe36659c397ba45c55709c87f6fad73dea7a4b09414f9e58c35.jpg

2024-10-11 23:19:57

Very cool. You know where to get it.
https://image.nostr.build/f704313135226b167796d172fcbc4ccb1dc1c8504be4246032d2f55f8d7fa97b.jpg
#nevent1q…hknx

2024-10-09 22:35:06

- reply

Love Spring but it seems development has stopped? @nprofile…t838

2024-10-09 22:33:05

Two well-known apps valued by privacy-minded users have just been added:
Tutanota and Standard Notes

2024-10-07 22:28:40

zap.store soon listed in Guulag Play?
👀
https://www.theverge.com/policy/2024/10/7/24243316/epic-google-permanent-injunction-ruling-third-party-stores
h/t @nprofile…lx75

2024-10-06 23:32:48

- reply

*I didn't mean the APK, but the recipe on how to fetch version and artifact, so once it's set up we automate that

2024-10-06 23:30:12

- reply

Good question! Each APK needs to be added manually and so it's vetted. With updates to the UI we'll start making these things more clear. And next year integrating DVMs to help with these checks.
The idea is to bring many more FOSS apps that are not as releases on Github.
In reality this doesn't change much from the current practice of ingesting Github releases. Some of those could theoretically be compromised.

2024-10-06 23:02:11

Well, it's on zap.store now 👀
How? I'm writing the new parser that picks up APKs from all over the web from our indexer.
Work in progress! But expect a TON more apps soon.
https://image.nostr.build/b64b7ac9ed9d42ab1f9b629e23a9c9c17d643b50d479cb48e2d92f66120ab124.jpg

2024-10-06 22:19:59

The status quo in app distribution:
"AntennaPod is officially published only in [Play Store and F-Droid] because we don’t have the time to support more."
"All other stores listing AntennaPod copied the app without our explicit permission. We are not responsible for updating those or making sure they work correctly."
"F-Droid usually takes a few days until updates become available. If an update is still not available more than a week after its release, feel free to let us know"
Now imagine all app releases signed on nostr by developers. As soon as they publish the event, updates get instantly pushed to the users. Secure*. Social. No third parties required. Permissionless. Directly monetizable. Unstoppable.
We are going to make it happen.

2024-10-03 00:07:26

- reply

Awesome!

2024-10-02 18:53:13

Ladies and gentlemen, Coracle by @nprofile…ntf8 is in the house!
https://image.nostr.build/68f92bd2a3986ec9cc3505312d390bc248bec38b97a905650b01baf5d4017a5b.jpg

2024-10-02 18:41:56

- reply

By the way, @nprofile…ntf8, I tested with the following snippet and it did work for me:
Just run it like: zapstore publish coracle (that will pull from github)
coracle:
android:
repository: https://github.com/coracle-social/coracle
artifacts:
- app-release-signed.apk

2024-10-02 16:57:25

- reply

@nprofile…ntf8 would you mind updating (zapstore install zapstore, or pull from latest) and let me know if it works now? 🤞

2024-10-02 16:53:00

- reply

@nprofile…mqvn icon and images for ya🤙

2024-10-02 16:52:03

🚀 zap.store cli 0.1.0 released
Developers:
- you can now pass icon and images for your app
- the "artifacts" yaml attribute is no longer needed if you don't pull from github (and use the -a argument)
- identifier also no longer needed
- updated docs in the repo README
🏋️ Those trying to upload bigger APKs, this is now fixed as well.
To update run: zapstore install zapstore
(or install from the release on github)

2024-10-02 14:46:01

- reply

Thanks! Mastodon seems ok to me, can you try refreshing?

2024-10-02 00:15:58

- reply

You can also paste your npub and it will work! Again, if you trust the author/signer (greenart7c3) then just install

2024-10-02 00:05:15

- reply

Thanks for trying out zap.store! If you trust our account you can go ahead and install. The NIP-05 is not necessary, but better when you want to have extra assurance

2024-10-01 15:19:43

- reply

Would be so cool. The current categories are "list of apps" events (kind 30267), we could allow devs to push these to the relay as well. Needs more thought, though

2024-10-01 13:07:21

- reply

Everything will be released in due course, but what are you referring to specifically? Cli first (likely today or tomorrow) and then the Android app

2024-09-30 23:53:03

- reply

I think it's the same issue of the other day. It's fixed! Working on other bugs as we speak, to be able to release all the fixes asap!

2024-09-30 23:49:38

- reply

Also working on the Android app where bugs have been fixed. I don't think it's a LineageOS specific issue. A little more patience and we'll have 0.1.4 released (or you can try building from source!)

2024-09-30 19:53:25

An issue where the button reads "Sorry release is incompatible with your device" has just been fixed.
If you keep experiencing it, go to Settings (⚙️) and tap on Delete cache.
It was a data issue where the latest release events were invalid (numbers instead of strings in nostr tags). These releases (around 30) were removed from the relay.
Since we are transitioning to zapstore-cli to power our indexer, which always generates valid events, the problem is fixed but it will take a few days to deploy. So no updates for a few days.
Developer signed releases are not affected.
#nevent1q…4tvd

2024-09-30 17:55:28

- reply

Thanks. I'm fixing that rn

2024-09-29 18:01:50

- reply

Interesting, I will check. Thanks

2024-09-28 17:26:56

- reply

@nprofile…vzaw if you'd like to display images and a longer description you can pull extra metadata from the Play Store (use --overwrite-app)

2024-09-28 16:42:30

One of my dreams come true, @nprofile…s8dt by @nprofile…vzaw is now self-signed in zap.store!
(If you see the old signer, pull to refresh)
https://image.nostr.build/223c442dfeb91ab622f088df78e8056a8b0ee29296e5ee2b8826cfda5511443e.jpg

2024-09-28 16:37:10

- reply

I'm not against it but you need to trust the website host then.
Ideally we want multiple websites pulling these events. https://zap.store eventually will show this info, and then something like an app in nostrudel "more" could work too

2024-09-28 16:13:09

- reply

zap.store does this for you, but you are right that for verifying zap.store itself you need to either trust the domain or verify the hash.
This is why we publish hashes in our nostr profile.
If you already have AppVerifier, that's one way. Or you could do it in the computer. Would be nice to have tutorials for both

2024-09-28 14:48:27

- reply

Which hashes? Can you explain what your goal is?

2024-09-28 14:42:30

- reply

Awesome. I need to delete the previous app event for Amethyst version to show! When I get back to the computer

2024-09-28 13:44:08

- reply

Owned by whom?

2024-09-28 13:36:05

- reply

That's the whole point of app stores

2024-09-28 13:20:22

One of zap.store goals is to finish what PGP never could.
I share your concern and to bridge the PGP-nostr gap we have NIP-39 cryptographic identities that soon will be integrated into zapstore-cli.
https://github.com/nostr-protocol/nips/pull/1335
Other tools could be built to leverage these events and feed them into Openkeychain for example.
That said, you mention "updates" and a phone which I suppose is Android. Keep in mind that the OS handles this verification for you, so no worries except on first install.
#nevent1q…jg7h

2024-09-26 18:29:36

- reply

If you have ideas a great place to leave them, too, is:
https://github.com/zapstore/backlog/issues

2024-09-26 18:22:31

To all our users who leave feedback in the Settings screen... we don't answer but do read you and take your comments into consideration
🫂

2024-09-25 21:15:54

- reply

Great job guys... LF...GO!

2024-09-25 20:31:31

- reply

Fixed and pushed! If you want to build from source it's there, otherwise I'll cut a new release tomorrow

2024-09-25 20:03:16

- reply

Thanks! It will go with a big fat closed source label 😄

2024-09-25 17:51:02

- reply

💪

2024-09-25 16:31:22

- reply

All that should be fixed now!
zapstore install zapstore to update to 0.0.6 and try again

2024-09-25 16:28:37

- reply

@nprofile…rdp9 @nprofile…9zgs this should fix it for you!

2024-09-25 16:27:15

🚀 zap.store cli 0.0.6 released!
Bug fixes and small improvements
To update:
zapstore install zapstore

2024-09-25 01:59:28

- reply

Thank you!

2024-09-25 01:58:34

- reply

Actually zap.store fetches most apps from Github. But with additional security guards (checking hashes signed by the dev), web of trust display and better discovery. And soon zaps. Obviously Github directly has way more apps, but we're getting there.

2024-09-25 00:29:09

- reply

PWAs are planned, it's one way we'll support iOS.
Also experimented with packaged PWAs, that don't require visiting a website

2024-09-25 00:26:06

- reply

Why not download both from zap.store instead?
The Amber release for example is signed by the developer himself. We hope to do the same for 0xchat soon

2024-09-24 19:05:11

Very interesting, and exactly what we seek to fix.
Beyond curated relays and web of trust, there definitely are plans to incorporate external services reports for malware, reproducible attestations and much more - likely through a DVM open market.
Some planned: https://github.com/zapstore/zapstore/milestone/3
#nevent1q…ymtn

2024-09-24 18:58:14

- reply

Need t-shirt of this

2024-09-24 18:57:24

- reply

Awesome @nprofile…ahfv ! We did have some similar by @nprofile…u9av but need to find where they are

2024-09-23 14:46:08

- reply

Heads up: There is something broken when accessing the citrine screen, and I can only have a look later today. Spoke too soon😄

2024-09-23 14:06:16

Citrine has been signed and published by @nprofile…fpck , just sayin' 🤩

2024-09-21 14:06:45

- reply

Probably us 😄

2024-09-20 20:22:22

- reply

Ouch, sorry about that. I will be fixing that over the weekend and let you know!

2024-09-20 15:55:01

It's available now!
@nprofile…9zgs if at any point you'd like to self-publish just let us know.
#nevent1q…dtc4

2024-09-19 12:50:42

Great question! Zapping releases is coming soon.
Currently focused on bringing more developers to self publish, and ironing out the last bugs around those tools. Then, entering the zap milestone.
I'll make zap.store live up to its name⚡😄
#nevent1q…hx0n

2024-09-18 16:26:04

- reply

No worries, thanks!

2024-09-18 15:01:17

- reply

Hmm interesting. What happens when you tap on Update?
It might be an issue on their side, as most APK versions resolve via versionCode and not versionName (the one you are seeing)

2024-09-18 12:19:29

- reply

Love it!

2024-09-18 11:42:19

- reply

Cool that it worked, but that is strange. What YAML were you using?

2024-09-18 11:39:18

Couldn't agree more
@nprofile…jpuv we need an icon kit!
#nevent1q…9h5p

2024-09-17 21:27:37

- reply

Thanks 🫂 and as I said in my quote-note the situation will improve with everything I mentioned.
It is a way to get the "follows who follow" feature in an optimal way (fast, data efficient, and sorted by pagerank to improve recognizability - if that word even exists). With the tradeoff of partially trusting a service provider.
Great article, btw.

2024-09-17 21:04:55

- reply

Yes, completely agree. We want something like this.

2024-09-17 18:37:56

Thank you for the tough love, fiat 😅
Yes, the "follows who follow" IS a WoT API service - there is no other realistic way to solve this problem.
That said we're slowly working to make this service provider: (a) faster and more stable, (b) a DVM or more likely return a signed nostr message - vs the current plain response-, (c) some client-side verification, (d) allow swapping service providers, once we settle on a standard.
These WoT service providers obviously will compete in a nostr open market.
#nevent1q…6zhy

2024-09-17 18:25:49

- reply

It is there! But it has an error (no files were published) @nprofile…6e34 do you want to try with zapstore-cli 0.0.5?

2024-09-17 01:15:48

- reply

Tomorrow I will try on my end!

2024-09-16 18:12:18

- reply

You need to uninstall first, read the release notes

2024-09-16 18:11:34

- reply

No idea, please tag them

2024-09-16 13:21:18

- reply

Same here! I'll look into this today

2024-09-15 23:12:46

- reply

Thanks for reporting! I ll take a look

2024-09-13 22:28:03

- reply

Next week I'll be working mostly on the Android app...
Do you mean when tapping on Update on the Android prompt/dialog?
When did this strange behavior start happening?
Can you record a screencap and/or share device info (in the ⚙️ screen) via DM?

2024-09-13 22:23:37

- reply

Close.
( Expect it soon, though!)

2024-09-13 19:25:43

Zap.store CLI 0.0.5 released✨ Improvements around publishing, so that even more developers can self-sign.
Download from https://zap.store or https://github.com/zapstore/zapstore-cli (docs are in the readme)
To update: zapstore install zapstore 🐶
🔑 Also: We JUST had a very well known Android app signed by its dev! Guess which

2024-09-12 19:12:35

- reply

You're absolutely right. Java can and should be used that way. Culturally though, the average Java programmer will tend to bloat things, at least that is my experience over the years.

2024-09-12 17:33:06

- reply

My Flutter-generated APKs are very small (8-10MB) and most of what I see written in JS is way bigger. So I actually think the opposite!

2024-09-12 17:31:19

- reply

Nicest languages IMO 🤙

2024-09-12 17:30:47

- reply

Of course!

2024-09-12 17:30:31

- reply

I like Flutter

2024-09-12 17:30:10

- reply

Super interesting, thanks! I wonder if we have other ways of compiling to Dalvik than through JVM bytecode

2024-09-12 17:29:15

- reply

Interesting! I just learned about Uniffi

2024-09-12 16:15:37

Android developers... what language/platform do you use to build your apps?
Kotlin, React Native, Capacitor, Flutter, any others?

2024-09-11 16:59:07

- reply

Sorry bug, we're fixing it

2024-09-11 13:20:20

- reply

Would you like to try it now? Hopefully it works.
see https://github.com/zapstore/zapstore-cli
I already whitelisted your npub in the relay

2024-09-11 13:17:45

- reply

The other option is going the AltStore or sideloadly route, but I'm not sure about UX

2024-09-11 11:54:21

- reply

It would not, PWAs are web applications

2024-09-10 17:46:05

- reply

This would be awesome. But I found a bug in the publisher when trying to upload the APK. Once I fix this, I will let you guys know.
https://github.com/zapstore/zapstore-cli has a readme with documentation.
In addition, the Android client needs an update to clearly show this software is closed source.
We'll be in touch!

2024-09-10 17:20:09

- reply

@nprofile…pyug are you down for that in a few weeks? I'd like to release new versions of the Android client (that hopefully works for you!) and cli publisher first

2024-09-08 13:49:54

- reply

Very cool! If only Apple didn't have an app store monopoly.
We've been brainstorming how to approach iOS, and we have some ideas. Longer term

2024-09-08 13:47:27

- reply

That's the dream! Well, at least Obtainium. Working on it!

2024-09-07 03:13:18

- reply

Is it open source? Public APK?

2024-09-06 17:10:45

- reply

The website is a complete WIP right now. Appreciate the offer! We def want that once we redesign

2024-09-06 16:43:59

- reply

This is the way.
I'm dreaming a bit here, but one day we'll have an Aurora-like store within zap.store (would run on a separate relay)

2024-09-06 02:47:15

- reply

Yes - except devs are starting to nostr-sign their APKs so in that case, we are enabling self sovereign app downloads directly from the dev, no middlemen.

2024-09-06 00:18:53

- reply

Yeah, not the first time I hear that on Lineage. Unfortunately I haven't yet tested on that OS.

2024-09-06 00:16:31

- reply

No. Obtainium allows downloading APKs from remote sites. It therefore has a huge catalog, but search UX is terrible imo. We index instead, so have a smaller catalog but better search. But we could add an auto index, or bring your APK functionality. And obviously we strive to have as many devs signing apps on nostr, while Obtainium likely won't.

2024-09-05 20:52:57

- reply

See https://github.com/zapstore/zapstore-cli
Webapps: not yet, but eventually, yes!

2024-09-05 20:51:11

- reply

The opposite is more likely😄 That you can find any github, gitlab, fdroid, etc apps from within zap.store