Software publishing
ngit publishes downloadable releases and pullable containers with two related but distinct event models. Both keep signed, mutable metadata on Nostr and put content-addressed bytes on Blossom servers.
Releases: NIP-82
NIP-82 describes three records:
| Record | Kind | Purpose |
|---|---|---|
| Software application | 32267 | Identity, description, publisher, platforms, and optional source repository |
| Software release | 30063 | Version, channel, release notes, and the authoritative asset list |
| Software asset | 3063 | File hash, media type, platform compatibility, and build metadata |
An application can link to the NIP-34 repository containing its source. Each release points to its application and to the exact asset events for that version. Assets commit to their files by SHA-256, so a client can verify bytes downloaded from any advertised Blossom server.
NIP-82 does not define installation or dependency resolution. Those remain client concerns. Publish releases with ngit covers the maintainer workflow, including generic archives and Zapstore-compatible Android releases.
Containers: ncontainer
The ncontainer draft defines an addressable kind 30624 event. The event maps familiar OCI tags, such as latest or 1.4.2, to image manifest digests. OCI manifests, indexes, configs, and layers are already addressed by SHA-256, so the same bytes can be stored directly on Blossom.
A read-only OCI Distribution gateway resolves the signed tag map and serves the verified blobs to ordinary container clients. ngit's current publishing profile also binds the container event to its NIP-34 repository, so publication requires a confirmed repository maintainer.
A container archive attached to a NIP-82 release is still a downloadable file. It does not become a pullable container repository. Use ngit container publish when tools such as Docker or Podman need to pull the result by name and tag.
Why Blossom fits both
Blossom locates a blob by its SHA-256 hash. Publishers can place the same bytes on several servers, while events carry the identity, relationships, and mutable pointers that hashes alone cannot express. A storage provider can therefore be added or replaced without changing the signed release or container identity.