# AppStore

Installs new Lua apps from one or more public Xteink repositories.

## Bootstrap

Copy this directory to `/.apps/AppStore` on the SD card. On first launch, AppStore creates `repositories.txt` from `repositories.default.txt`.

Repository entries use this format:

```text
XTEINK-REPOSITORIES|1
Name|https://host/path/catalog.txt
```

AppStore caches each validated catalog on the SD card. Select opens the cache when available; use Refresh to fetch the latest catalog.

Packages download into `/.apps/.install-<AppId>`, verify declared sizes and SHA-256 hashes, require `main.lua`, then rename into place. Existing apps are left unchanged; updates, including self-update, are not supported yet.

HTTPS is encrypted without peer-certificate authentication. An active network attacker can replace both metadata and payload hashes.