Rug Munch Media LLCLaunch app (opens in a new tab)
Rug Munch Media

Nostr — Signed Repository Announcements

Every public Rug Munch Media repository is announced as a signed NIP-34 event. Check the npub, the event and the relays without trusting a host.

Each public repository we ship is announced as a signed event on Nostr — the record that it exists does not depend on any server answering, ours included.
One signed kind 30617 event fans out to two relays, a GRASP clone and any Nostr client. NPUB · SIGNER kind 30617 14 repos · one key Relay · nostr.degenfeed.xyz wss:// — primary announcement store Relay · git.cryptorugmunch.com wss:// — git service, same host GRASP · clone over nostr:// no account, no forge, no DNS trust Any Nostr client verify the signature offline
Fig 1 — one signature, four independent ways to read it

One key, one record

Everything we publish is signed by a single key. Read the npub character by character before you trust anything filed under it.

Public key — npub npub1e97559tn2j6j02shalmn5x6xv5jt8ejlclh6sta8nln0n55whwtszyrqud Open the profile on njump.me — a browser, not a custodian.

What is actually signed

NIP-34 defines git work over Nostr: a repository is a signed event of kind 30617, and patches, issues and PRs are signed events too. Nothing in the event depends on a forge account, a DNS zone or a certificate authority.

We announce 14 public repositories as kind 30617 and republish them to both of our relays:

Relay Role
wss://nostr.degenfeed.xyz Primary announcement store
wss://git.cryptorugmunch.com NIP-01 relay on the git service host

The second host is also our GRASP server, so the same address answers a git clone and a relay query — no account, no forge, no proxy:

git clone nostr://npub1e97559tn2j6j02shalmn5x6xv5jt8ejlclh6sta8nln0n55whwtszyrqud/git.cryptorugmunch.com/<repo>

What a commit touches

A commit is one action and four records — the announcement is what survives a host disappearing.

  1. commit
  2. Forgejo
  3. mirrors
  4. kind 30617
  5. relays

Verify it yourself

01

Pull the event

Ask a relay for announcements authored by our key.

nak req -k 30617 -a npub1e97…zyrqud wss://nostr.degenfeed.xyz
02

Read two tags

The d tag is the repository identifier; the clone tag is the URL we claim. Check both against what you cloned.

git remote -v
03

Match the commit

The signed announcement points at one commit. Your clone must contain it.

git log -1 --format=%H

If the signature verifies and the commit matches, the code you are reading is the code we signed for — regardless of which host served it.

The tooling, plainly

NIP-34 is a spec, not an app. The app we run is ngit, a Rust binary that publishes announcements (kind 30617) signed with our key, carries patches and issues as events, and reconciles a git host’s refs with the signed state.

cargo install ngit          # or: nix run github:nostr-org/ngit
ngit account login          # import the signer you publish with

ngit is not a git host: objects still live behind an HTTP or SSH endpoint — ours at Forgejo, which answers anonymously.

Why the record outlives its host

Taking a forge offline hides one copy. It does not unsign an event. Censoring the record means censoring a signed event across every relay that carries it and every client that republishes it — a different order of effort from pulling one server.

The four transports, the mirror cadence and the Radicle archive are on Our Code — Four Forges, One Source.