I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.
As much as I agree, IPFS is still very much under construction and I don't think any known package managers got started after IPFS was reliable.
You can experiment with ipfs-backed git remotes though. That's already possible.
gx is a generic package manager on top of IPFS that uses git-style hooks for adding per-language support. It's already being used to manage dependencies on the go-ipfs project: https://github.com/whyrusleeping/gx
Bonus: there's also a IPFS git remote implementation! https://github.com/cryptix/git-remote-ipfs
Yes the IPFS implementation might change but not the content multihash addressing. Linking to data with those addresses is the generic 'package management' that solves all these problems (references to mutable data at mutable origins, circular dependencies, data caching, namespace conflicts). The specifics of resolving links will hopefully be something we don't think about much.
I've played around with ipfs.js for resolving links into eval'd js at runtime and imagine a npm replacement would be pretty trivial. The IPFS peer to peer swarm seems stable to me but you could also dump all your hash-named files into a s3 bucket or something as a fallback repo.
No signatures, no (at least!) an IPFS mirror as a backup option - how can one trust NPM or the likes?!
Re:I've Just Liberated My Modules
by kylecordes on Wednesday March 23, 2016 @12:05AM
(#11342084)
NPM doesn't even have immutable versions. Many would love to see this improved.
What you mean by that? It used to be possible to republish a version (it broke our build when a dep was republished with a breaking change, that's how I learnt about it) but this was fixed some 2-3 years ago IIRC
Re:I've Just Liberated My Modules
by Ericson2314 on Wednesday March 23, 2016 @12:57AM
(#11342247)
Somewhat related, I just coincidentally stumbled upon https://github.com/alexanderGugel/ied . "Upcomming Nix-inspired features", to paraphrase their README, could well prevent this debacle.
(And btw, We Nix users very much do hope to start using IPFS :).)
There’s already apt-get over Freenet: http://127.0.0.1:8888/freenet:USK@oRy7ltZLJM-w-kcOBdiZS1pAA8...
Git has crypto for a reason.
Every package manager must have it too.
There is already gx package manager: https://github.com/whyrusleeping/gx
[0] https://github.com/ipfs/ipfs