Skip to content

Open protocols

Listings, files and zaps run on open protocols, outside any Zapstore database. Here is how Zapstore uses each one.

Because this data lives on open protocols, anyone can read it, mirror it or run a replacement catalog without asking Zapstore. A developer dropped from one catalog can publish to another, and people can switch catalogs inside the same app.

Nostr

Nostr carries everything that describes an app. A listing is a set of signed events, a developer is a pubkey, and a catalog is a relay that serves the events. Anyone can read them and check their signatures, whichever relay served them.

Listings

An app, its releases and its files are three kinds of event. A catalog relay accepts them, and the Android app reads them from the relay or from a bundle, the whole catalog in one download.

Identity and signing

A developer signs listings with their pubkey, and links it to the APK signing certificate with a claim (NIP-C1). A signed-in user has the same kind of pubkey.

Blossom

Blossom stores files by the SHA-256 of their bytes. Zapstore uses it for the files a listing points to: the APK, the icon and the screenshots. The catalog's Blossom server is https://cdn.zapstore.dev.

  • A file is named by its hash. An asset event carries the file's SHA-256. When it has no url, clients find the file by that hash on a Blossom server.
  • Where the file lives is the developer's choice. zsp takes the APK from the developer's release source, such as a code forge. It uploads the APK to Blossom only when there is no public source, and uploads the icon and screenshots.
  • The app checks the file, not the server. Whoever serves a file, Zapstore checks the download against the listing before it installs. See Security.
  • Uploads follow the same rules as publishing. A pubkey that may publish may upload. The catalog’s Blossom server accepts only APKs and images.

Lightning

Zaps pay developers directly over Bitcoin's Lightning network.

  • Zap receipts are how the app shows an app’s total and the people who zapped.
  • A zap goes to the pubkey on the app's current claim, not through Zapstore, with no fee. It is paid to the Lightning address (lud16) on that pubkey's profile.
  • With no current claim, the zap goes to the catalog that supplied the app, and the app says so. A listing has no zap field.

More on zaps for users is in Social, and for developers in Publishing apps.

Get Zapstore for Android

  1. Tap Download APK below.Scan the code with your Android phone’s camera.
  2. If Android asks, allow your browser to install unknown apps.
  3. Open Zapstore and finish the onboarding.
Download APK

v2.0.4 · 71.2 MB · Android 10+

Verify the download

On a computer, run shasum -a 256 <the file you downloaded>. It should print: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

If you have zsp, Zapstore’s publishing tool, zsp utils extract-apk <the file you downloaded> works too. Its hash should be the same SHA-256: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

On the phone, AppVerifier should show this signing certificate: 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Source code All releases and notes

Get zsp

  1. Download the file for your computer.
  2. Make it executable and put it on your PATH.
  3. In your project folder, run zsp.

Have Go? This does the same:

go install github.com/zapstore/zsp/v2/cmd/zsp@latest
macOS, Apple silicon Linux, x86-64 Linux, arm64

v2.0.1 · macOS and Linux

Verify the download

On your computer, run shasum -a 256 <the file you downloaded>. It should print the SHA-256 for the one you chose.

macOS, Apple silicon · 18.6 MB 99018fb9744e5ace2b44557550dc333496239912c0e9b1137266d4922c803346

Linux, x86-64 · 23.8 MB 1ef5373f8ecd9ba63d2c3fab98abb0d31b2244a2aac31b3749fb205c7d5f5b38

Linux, arm64 · 22.1 MB e421005ee47cba58293dce4277bb784e4cfe706dbbcb8617d671629d0238be18

Source code All releases and notes