At this level
com.pipobscure.bundle · 4- com.pipobscure.bundle.attestation record A statement by the repository's owner about a bundle — that they vouch for it, or that it is bad — identified by its whole-file hash — the hash a bundle signature covers — or about a suite, identified by the hash of what it says (see com.pipobscure.bundle.suite). The record key is that hash in lowercase hex, so there is at most one attestation per account per bundle or suite, and a verifier knows which record to ask for. A good attestation of a suite counts for each bundle installed from it; a b
- com.pipobscure.bundle.like record The repository's owner likes an app: a star for it, across its releases. It is of the app's listing (com.pipobscure.bundle.listing), and each like comes with a post from the same account saying so. The record key is the sha256 of the listing's at:// address in lowercase hex, so an account has one like of an app; liking it again counts on that record and lists the new post. A like vouches for nothing; nothing installs or refuses by it.
- com.pipobscure.bundle.listing record A bundle the repository's owner makes available under a name: the record key, which is also what it installs as. It is an app, or a plugin for one, as its subject says. The record says only where the bundle is fetched from — a url, or a domain whose 'nzip:' TXT record names one, exactly one of the two. It vouches for nothing, and whatever is fetched is verified like any other download.
- com.pipobscure.bundle.suite record A set of listed bundles the repository's owner makes available to install together, under a name: the record key. Installing the suite installs each member as it would be installed by itself, and an update follows the suite as members are added and taken out. The suite vouches for none of them: each member is reviewed and verified on its own. What it can do is set a minimum — a signer and attesters a member must carry — below which that member is refused.