Skip to content

Open catalogs

A catalog is a list of apps, published as signed public data on Nostr. You choose which catalogs your phone reads, and a ban in one catalog doesn’t reach the others.

What a catalog is

A catalog is a list of apps and their releases, served by a catalog relay and identified by the catalog’s pubkey. Each listing is a signed Nostr event, public data that anyone can read and check, so the same app can appear in more than one catalog. Each catalog sets its own rules for who may publish. Run your own catalog covers what a catalog relay does.

Who publishes the releases

An app in a catalog is a chain of releases, and three kinds of pubkey can add to it:

  • The catalog’s own pubkey. A catalog can list apps itself, for example from their public release pages. Zapstore’s default catalog does this with its indexer.
  • The developer’s pubkey, once they have claimed the app by proving they hold its Android signing key.
  • A delegate pubkey the developer names in their claim, typically for CI. It can publish releases but cannot change who owns the app.

The release with the highest version code is the current one, whoever signed it. An app that only the catalog has ever published is unclaimed. On a claimed app, the catalog can still fill in releases the developer skipped, and they appear under the developer’s listing. Every release, from any of the three, must be signed with the app’s certificate or one linked to it.

Choosing catalogs

Your phone starts with the catalog Zapstore ships with. Settings lists your catalogs in order. You can add a catalog by its pubkey (an npub, a hex key, or an nprofile), reorder the list, and remove a catalog as long as another remains. Each update reads every catalog in the list, one after another, and one that fails does not stop the next.

Your phone

Reads its catalogs in order

1. The catalog it ships with

Unless you replace it

2. A catalog you add

Supplies the apps the first does not have

When two catalogs list the same app, the one higher in the list supplies it.

Bans

Each catalog decides which publishers it accepts. A ban removes a publisher from that catalog only. Another catalog can still list the app, and you choose which catalogs your phone reads.

Default catalog explains how the catalog Zapstore ships with applies a ban.

Zaps

When an app is claimed, a zap goes to the developer’s pubkey. When it isn’t, the zap goes to the catalog that supplied the app, and the app tells you before you send it.

Get Zapstore for Android

  1. Tap Download APK below.Scan the code with your Android phone’s camera.
  2. If Android asks, allow your browser to install unknown apps.
  3. Open Zapstore and finish the onboarding.
Download APK

v2.0.4 · 71.2 MB · Android 10+

Verify the download

On a computer, run shasum -a 256 <the file you downloaded>. It should print: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

If you have zsp, Zapstore’s publishing tool, zsp utils extract-apk <the file you downloaded> works too. Its hash should be the same SHA-256: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

On the phone, AppVerifier should show this signing certificate: 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Source code All releases and notes

Get zsp

  1. Download the file for your computer.
  2. Make it executable and put it on your PATH.
  3. In your project folder, run zsp.

Have Go? This does the same:

go install github.com/zapstore/zsp/v2/cmd/zsp@latest
macOS, Apple silicon Linux, x86-64 Linux, arm64

v2.0.1 · macOS and Linux

Verify the download

On your computer, run shasum -a 256 <the file you downloaded>. It should print the SHA-256 for the one you chose.

macOS, Apple silicon · 18.6 MB 99018fb9744e5ace2b44557550dc333496239912c0e9b1137266d4922c803346

Linux, x86-64 · 23.8 MB 1ef5373f8ecd9ba63d2c3fab98abb0d31b2244a2aac31b3749fb205c7d5f5b38

Linux, arm64 · 22.1 MB e421005ee47cba58293dce4277bb784e4cfe706dbbcb8617d671629d0238be18

Source code All releases and notes