From bfc777c18ba6dfbe738dd041f32ca3d0b00156ac Mon Sep 17 00:00:00 2001 From: SkateSpots Date: Fri, 30 Oct 2026 23:17:54 +0700 Subject: [PATCH] docs: make distribution Nostr-only, no external identities --- AGENTS.md | 43 ++++++++++++++++++++++-------------------- distribution/README.md | 37 ++++++++++-------------------------- 2 files changed, 33 insertions(+), 47 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 62cd2cb..6375106 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -2416,6 +2416,13 @@ Rules: `node scripts/smoke-test.mjs` manually before shipping. ### Distribution without GitHub +> **Owner decision (2026-10-30): no external identities.** Distribution must +> stay self-hosted and Nostr-based. Do **not** create or ask for GitLab, +> Codeberg, GitHub, email or F-Droid-main accounts. The local Forgejo admin +> account and the self-hosted F-Droid repo key are infrastructure credentials, +> not third-party identities. F-Droid main and IzzyOnDroid are therefore +> **out of scope**. + - **Self-hosted Forgejo:** `https://git.skate-spots.org/skatespots/SkateSpots` (public source, registration disabled, admin credentials only on the relay host). It runs on `185.18.221.2` behind Caddy; do not commit its credentials. @@ -2434,13 +2441,10 @@ Rules: The developer APK signature is unchanged; the repo key only signs indexes. A backup of the repo keystore/config is in `~/.config/skatespots/fdroid-repo/` (mode 600). -- **F-Droid main/IzzyOnDroid:** **not submitted yet.** Both are external review - processes and require an account/email, which this machine does not own. Do - **not** claim they are live. Source, APK, fastlane metadata and - `distribution/fdroiddata/org.skatespots.app.yml` are ready. F-Droid main signs - with its own key and cannot install over the Zapstore APK without uninstalling - (local data loss). Prefer the self-hosted repo/Obtanium until that is - explained clearly. +- **F-Droid main/IzzyOnDroid:** **out of scope by owner decision.** Both require + external GitLab/Codeberg identities and review; do not submit, create accounts, + or present them as live. The self-hosted F-Droid repo above is the supported + F-Droid-family channel. - **No GitHub required.** Keep Zapstore, Forgejo, the self-hosted F-Droid repo, and the static page in sync for each release. @@ -2466,20 +2470,19 @@ Rules: Local backups: `~/.config/skatespots/forgejo-admin.txt` and `~/.config/skatespots/fdroid-repo/` (mode 600). -### External submissions (do not fake) -- **F-Droid main:** blocker is not code — it is a GitLab account, review and - F-Droid's signing key. An agent cannot create/verify an external account or - pass review. The recipe was locally test-built from a clean clone at - `5ebf741` (unsigned APK); F-Droid CI is still authoritative. Only start this - when the owner supplies an account/email and explicitly accepts the - signature/data-loss implications. -- **IzzyOnDroid:** app listing submissions are handled through their external - listing/review process; source and APK are ready. Same account/email blocker. -- **Obtanium:** there is no store submission. Users add the latest Forgejo +### Nostr-only distribution (no external identities) +- **Zapstore** is the Nostr-native app store/update channel; keep publishing + release events there. +- **Obtanium** is URL-based, not an account: users add the latest Forgejo release URL (HTML source if needed) or the self-hosted F-Droid repo. -- **Ready-to-post text:** `distribution/SUBMISSION.md` has the F-Droid RFP and - IzzyOnDroid issue drafts. Posting still needs the owner's GitLab/Codeberg - account; never invent one. +- **F-Droid main and IzzyOnDroid do not support Nostr identities.** They are + intentionally not pursued. Do not create or request GitLab/Codeberg/email + accounts, and do not claim those stores are live. +- The local Forgejo admin account, the relay, and the F-Droid repo signing key + are self-hosted infrastructure, not third-party identities. +- The F-Droid recipe remains in `distribution/fdroiddata/` only as an unused + technical reference. It was locally test-built at `5ebf741`, but must not be + submitted. ### Deploy - **Web (auto)**: a systemd user timer (`skatespots-deploy.timer`) runs `scripts/auto-deploy.sh` every ~3 min. When `origin/main` changes it builds and runs `netlify deploy --prod --dir=dist`. It deploys **only committed code** (skips if tracked files are modified) and never mutates a dirty tree. **Doc/scripts-only commits are skipped** (matches `AGENTS.md`/`*.md`/`scripts/`/`cvm-server/`/`skills/`) — Netlify bills **15 credits per production deploy**, so don't spend them on non-site changes. One-time setup: `netlify login` + `netlify link`. Logs: `journalctl --user -u skatespots-deploy`. Manual run: `scripts/auto-deploy.sh`. diff --git a/distribution/README.md b/distribution/README.md index d584867..f047b75 100644 --- a/distribution/README.md +++ b/distribution/README.md @@ -51,36 +51,19 @@ The repository metadata and APK are served from the relay host. The repo index is signed with a repository key stored on that host; the APK itself keeps the SkateSpots developer signature. -### F-Droid main and IzzyOnDroid +### No external store identities -F-Droid main requires a public, clonable source repository (the Forgejo URL -above), an accepted `fdroiddata` recipe, a reproducible build and maintainer -review. IzzyOnDroid is the easier external submission step. Both remain -external-review processes; the self-hosted repo above is usable without waiting -for either. +**Owner decision:** distribution stays self-hosted and Nostr-based. No GitLab, +Codeberg, GitHub, email or F-Droid-main accounts are created or requested. -Recipe draft: `distribution/fdroiddata/org.skatespots.app.yml` -Store metadata: `fastlane/metadata/android/en-US/` +F-Droid main and IzzyOnDroid both require external identities and review, so +they are intentionally out of scope. The self-hosted repo above is the supported +F-Droid-family channel. -The Android project is generated by Capacitor and intentionally not committed, -so the prebuild steps must be verified in the F-Droid build environment before -submitting to F-Droid main. A fresh local clone at commit `5ebf741` completed -the recipe's `npm ci → android:init → android:sync → assembleRelease` path and -produced `app-release-unsigned.apk`; F-Droid CI is still the authoritative -check. - -IzzyOnDroid submission details, when you want to send it: - -- App ID: `org.skatespots.app` -- Source: `https://git.skate-spots.org/skatespots/SkateSpots` -- APK: the signed asset on the latest Forgejo release -- License: `AGPL-3.0-only` -- Category: Sports -- Summary: `Local-first skate map, crews, events and marketplace` -- Keep the developer signature; do not ask users to replace an existing install - with an F-Droid-main-signed build. - -No GitHub account is used anywhere in this path. +`distribution/fdroiddata/` and `fastlane/` are kept as an unused technical +reference only. A fresh local clone at `5ebf741` built the unsigned APK through +the recipe's `npm ci → android:init → android:sync → assembleRelease` path, but +the recipe must not be submitted. ## Release checklist