8000 Software applications events by franzaps · Pull Request #1336 · nostr-protocol/nips · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

8000 Software applications events #1336

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 9 commits into
base: master
Choose a base branch
from

Conversation

franzaps
Copy link
Contributor
@franzaps franzaps commented Jun 29, 2024

Rendered

This event represents an application as used in Zapstore. It is actively being used in a production setting for many months already.

This relates to NIP-51 (kind 30063), those artifact sets point to their application (this event, kind 32267).

Feedback welcome

@vitorpamplona
Copy link
Collaborator
vitorpamplona commented Jun 29, 2024

hum.. isn't it possible to merge this with kind 31990? Kind 31990 is insufficiently defined on NIP-89 but most apps already have their entry due to https://nostrapp.link/

We could just add the additional tags needed by zap.store to that definition.

@franzaps
Copy link
Contributor Author

NIP-89 is for apps that handle nostr events, isn't it? It's not at all what I'm defining here. In fact, 90%+ of the apps on zap.store do not handle nostr events.

It feels very contrived to try to fit this simple definition on the complexity of NIP-89.

@vitorpamplona
Copy link
Collaborator
vitorpamplona commented Jun 29, 2024

Yes, that's what NIP-89 needed it for, but those app definitions don't need to exist to solely respond to Nostr events. Actually, I believe most apps don't event that "response" field setup correctly. Right now they are just there to receive reviews.

DVMs also reuse the same kind to define their applications.

Reusing the kind doesnt mean you have to implement NIP-89 to support yours.

@franzaps
Copy link
Contributor Author
franzaps commented Jun 29, 2024

Are you saying I can keep my schema as-is and change 32267 to 31990? In such case I would have to change content which will break other NIP-89 clients.

Or do you mean I should stuff all my metadata into a stringified metadata and put it in content?

@vitorpamplona
Copy link
Collaborator

Hum.. yeah I missed the content discrepancy.

@pablof7z, do you see a possibility of merging those two?

Or are we going to have to define our apps in two places?

@franzaps
Copy link
Contributor Author

Do you know what is the rationale for putting stringified JSON in content (unless it has to be encrypted)? I've noticed the pattern in several places

@vitorpamplona
Copy link
Collaborator
vitorpamplona commented Jun 29, 2024

Do you know what is the rationale for putting stringified JSON in content

Dumb decisions. They probably just copied how kind 0 works :(

@franzaps
Copy link
Contributor Author
franzaps commented Jul 1, 2024

I also need data to be in tags for full text indexing purpose.

31990 seems built for something else which is fine: all apps can sign a 32267 and if they want nostr interop also sign a 31990.

I will keep using kind 32267 unless there's a better alternative to describe an application

@DanConwayDev
Copy link
Contributor

Love to see this and look forward to adding releases to nip34 clients.

Instead of referencing a nip34 announcement event in repository tag it should be referenced with an a tag so it will be indexed by relays. clients should look for an a tag with 30617 kind if repository is omitted.

The release event:

  1. should be moved into this nip from the example section of nip51.
  2. should be immutable and not a replaceable event. then trust attestations could be placed on the event eg. validation that the checksums of a reproducible build match.
  3. should include an optional ["commit-id","<SHA1-commit-id-used-to-build-release>"] tag

From a style point of view: I see most nips describe events using jsonc rather than a table of tags, which is easier to read. Is this now the standard?

lastly, the app event could support the maintainers tag like nip34 announcements This means clients could optionally interpret app events by the pubkeys listed with identical d tags as referring to the same app. ["maintainers", "<other-recognized-maintainer>", ...]

@franzaps
Copy link
Contributor Author
franzaps commented Jul 3, 2024

Love to see this and look forward to adding releases to nip34 clients.

Looking forward too!

Instead of referencing a nip34 announcement event in repository tag it should be referenced with an a tag so it will be indexed by relays. clients should look for an a tag with 30617 kind if repository is omitted.

Sounds great

The release event:

1. should be moved into this nip from the example section of nip51.

Sure, I can do that

2. should be immutable and not a replaceable event. then trust attestations could be placed on the event  eg. validation that the checksums of a reproducible build match.

We're probably talking about different things. The release set is a NIP-51 replaceable event (kind 30063) that is simply a pointer to a set of software releases (binaries). Trust attestations should be applied to NIP-94 (kind 1063) events because they carry a checksum of the binaries. Moreover, if a developer made a mistake in the file collection or a typo in the release notes, it's useful that they can update the event.

3. should include an optional `["commit-id","<SHA1-commit-id-used-to-build-release>"]` tag

Sure - in kind 1063s

From a style point of view: I see most nips describe events using jsonc rather than a table of tags, which is easier to read. Is this now the standard?

I don't think we have a standard for whether to include tables or not. Other NIPs use bullet points.

lastly, the app event could support the maintainers tag like nip34 announcements This means clients could optionally interpret app events by the pubkeys listed with identical d tags as referring to the same app. ["maintainers", "<other-recognized-maintainer>", ...]

This is currently done via attribution p/zap tags. I think a better idea is to include maintainers in releases (not apps).

@bezysoftware
Copy link
Contributor

Do you know what is the rationale for putting stringified JSON in content

Dumb decisions. They probably just copied how kind 0 works :(

Sorry to go off topic, but what is so bad about putting stringified json in content? Why are tags better?

@franzaps
Copy link
Contributor Author
franzaps commented Jul 4, 2024

@bezysoftware I would ask what is good about putting stringified JSON in content. It makes no sense to encode JSON inside JSON for no gain (unless it needs to be encrypted) since values of that object are strings anyway. Tags can be indexed.

Copy link
Contributor
@DanConwayDev DanConwayDev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

here is a suggested update reflecting the comments you were receptive to

@franzaps
Copy link
Contributor Author

I rewrote good part of this NIP.

As suggested by @NielLiesmons application description should be a wiki article. With that, developers also get access to better tools for updating information.

Presented the tags in jsonc example format as suggested by @DanConwayDev

Lastly, made a clarification on NIP-89.

Events on relay.zap.store do not yet conform to this spec but will be migrated shortly.

@franzaps
Copy link
Contributor Author

Updated the NIP to reflect the usage on Zapstore.

Since it has been used for months now and it's pretty stable, can we get this merged?

@staab
Copy link
Member
staab commented Dec 10, 2024

Is this in use by anyone other than zap.store?

@franzaps
Copy link
Contributor Author

@staab Not that I'm aware of.

Other than, maybe, @Giszmo ?

@staab
Copy link
Member
staab commented Dec 10, 2024

Normally NIPs are merged once there's some compatibility that needs to be ensured. It's good to have it documented in a draft, but update here when there are other apps using the standard

@franzaps
Copy link
Contributor Author

This data structure will probably end up in NDK and used in Yana and probably in a relay-based community started by @NielLiesmons

@vitorpamplona
Copy link
Collaborator

I am putting in on Amethyst right now. We can wait for the next release if we don't have any other client using this yet.

@DanConwayDev
Copy link
Contributor
DanConwayDev commented Jan 22, 2025 via email

@staab
Copy link
Member
staab commented Jan 22, 2025

I am putting in on Amethyst right now.

That's good enough for me. Are you implementing as is?

@vitorpamplona
Copy link
Collaborator

Just to display right now. I am not sure it makes sense to create it yet.

@kehiy
Copy link
Contributor
kehiy commented Feb 7, 2025

can we publish cli applications using this nip? so a linux package manager can use it for example?

@franzaps
Copy link
Contributor Author
franzaps commented Feb 9, 2025

@kehiy Absolutely, I am using it already for the Zapstore package manager (works on MacOS and Linux): https://zapstore.dev/docs/cli/manage/ -- it will get way more packages in the coming months

@v0l
Copy link
Member
v0l commented Feb 13, 2025

There is no reason for the release sets to be replaceable, can that be changed now?

@v0l
Copy link
Member
v0l commented Feb 13, 2025

Built a cli tool in rust to do publishing, no dependencies, no shell commands, only works for APK atm: https://git.v0l.io/Kieran/nap

@franzaps
Copy link
Contributor Author

There is no reason for the release sets to be replaceable, can that be changed now?

The first question would be what do we gain by changing it

@v0l
Copy link
Member
v0l commented Feb 13, 2025

There is no reason for the release sets to be replaceable, can that be changed now?

The first question would be what do we gain by changing it

Cant be rugged, small benefit, there is no actual reason for it to be replaceable

@v0l v0l closed this Feb 13, 2025
@v0l v0l reopened this Feb 13, 2025
@franzaps
Copy link
Contributor Author

You did not ask, but I will explain for context. It started out as a set of artifacts, just like any other set and that is why it's replaceable. Developers sometimes make typos in release notes or want to add an artifact for another operating system. We discussed it with fiatjaf and others over a year ago and we agreed on it. It has been working well in production for about a year now.

Would making it a regular event be more "correct"? Maybe. Not worth changing it in my opinion.

@vitorpamplona
Copy link
Collaborator

Break things while you can. If there is no need for a replaceable event, let's get rid of it and clean up the spec.

Also, does 30063 only keep the latest version? Or is the d-tag used as versions?

@franzaps
Copy link
Contributor Author

I don't have the energy to discuss this. Feel free to come up with something

10000
@franzaps
Copy link
Contributor Author

Break things while you can. If there is no need for a replaceable event, let's get rid of it and clean up the spec.

Also, does 30063 only keep the latest version? Or is the d-tag used as versions?

I keep events of kind 30063 around for every version. I only use the latest one in the UI (for now). Yes the d-tag is used for identifier and version (com.greenart7c3.nostrsigner@v2.0.1)

I recall asking developers to use --overwrite-release in zapstore-cli multiple times over the past few months (it replaces the kind 30063). It happened for different reasons; the point is they make mistakes and need it.

I know what will happen if we make this a regular event: they will end up asking me to delete the bad event from the relay so they don't have to bump and re-release

@vitorpamplona
Copy link
Collaborator

Can you add more guidance to the 30063? Right now it is just a line in the spec. This d-tag for instance should be defined so that other stores can use the same.

@franzaps
Copy link
Contributor Author

Can you add more guidance to the 30063? Right now it is just a line in the spec. This d-tag for instance should be defined so that other stores can use the same.

Actually I think it's there simply for convenience because version should be picked up from the linked e 1063 event and the identifier (d-tag) from the linked a 32267 event. So other stores could use another string (if I was doing that though, I would observe 30063 events in the wild first)

@vitorpamplona
Copy link
Collaborator

It would be nice to have a common way of doing. I could imagine switching back one version and having to "search" for what each store/publisher is using as dtag.

@v0l
Copy link
Member
v0l commented Feb 14, 2025

Also missing some documentation about the NIP-94, i published events as per this PR but it doesnt open in Zapstore app,

What is apk_signature_hash for?

@franzaps
Copy link
Contributor Author

Also missing some documentation about the NIP-94, i published events as per this PR but it doesnt open in Zapstore app,

What is apk_signature_hash for?

Should be apk_certificate_hash really (used in Zapstore to detect cert mismatches early which for sure will result in failed package updates). None of the NIP-94 extensions are documented. I don't know whether it should be another NIP or what.

@vitorpamplona
Copy link
Collaborator

Pictures and Videos were on NIP-94 and recently moved away from it into their own event kinds. That seems to have been a good move.

The same can happen here if software applications need their own NIP-94-like kind where not only specialized tags (like apk_certificate_hash) can be defined just for these file types but also the procedures to validate those hashes can be discussed.

@ZigBalthazar
Copy link
Contributor
ZigBalthazar commented Feb 22, 2025

@franzaps

+1 relay implementation:
https://github.com/dezh-tech/ddsr/tree/main/zapoli

@franzaps
Copy link
Contributor Author

Pictures and Videos were on NIP-94 and recently moved away from it into their own event kinds. That seems to have been a good move.

The same can happen here if software applications need their own NIP-94-like kind where not only specialized tags (like apk_certificate_hash) can be defined just for these file types but also the procedures to validate those hashes can be discussed.

Makes sense. Should we have one NIP for all software package related things? How about adding those things here?

@franzaps
Copy link
Contributor Author
franzaps commented May 27, 2025

Updating the NIP with:

And overall more clarity in the description.

This is work in progress, I plan to finalize it over the next few weeks.

@franzaps franzaps changed the title Software applications event Software applications events May 27, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

9 participants
0