Because every note has an identifier key.

You have a nostr account for each application, and that account publishes a signed note that links to all the code containing notes.

A new application version is just a new account note, all previous versions are just that accounts past notes.

You can compile an app made of any code notes from any contributor.

It’s signed by the key that controls the nostr account.

It’s ridiculously simple.