Subnostr

Isn't the fake repo event issue similar to spoofing NIP05 for domains you don't own?

Sure, anyone can pretend to have elon@x.com nip05, but there is an easy way to verify it.

Sure WoT all things, but clients should also be able to easily verify that the repo holds the maintainers.yml ?

if ngit is liked to remote git repo, it can verify maintainers.yaml ( yml ? ), but depends on how "client " is implemented. how about local repo ?

Please Login to reply.

Ngit is just local. Has no effect on the remotes listed as clones. Someone has to git push to those.

But if you push a maintainers file with your npub in it, nip34 clients can verify that the repo event author has write permissions.

So in a way, you can "signal" linkage