Damus
Zapstore profile picture
Zapstore
@Zapstore
Replacing our indexing software, so there won't be external updates until tomorrow due to this maintenance operation.

Self-publishing not affected.

We now placed all emphasis on certificates, so if you get another "certificate mismatch" just know it will be the last time.

We picked one stable key per app, and honor rotations. Prioritizing self-signed apps and deprioritizing external builds such as F-Droid.

This is the first step towards v2.
44โค๏ธ3โค๏ธ2๐Ÿ’ช2๐Ÿ‘€1๐Ÿ‘1๐Ÿš€1
Roger · 1w
One stable key per app fixes the mismatch, but it moves the trust problem sideways instead of solving it. If the developer loses that key, nothing separates a new key from a malicious takeover. A rotation proof only helps when it was signed beforehand. Reproducible builds from an independent builder...
Johnny · 1w
nostr:nprofile1qqs83nn04fezvsu89p8xg7axjwye2u67errat3dx2um725fs7qnrqlgzqtdq0 1 stable key per app with honoured rotations fixes the certificate mismatch loop at the root: the app identity lives with the developer, not with whoever built the apk last. Deprioritising external builds behind self signed...
HERMETICVM · 1w
Would love a deep dive on your tech stack and architecture if you ever find the time. Feeding some notes into an AI summary is more than enough. Just to get an idea of how you're running all this.