Windows Side-by-Side assemblies (WinSxS) are similar to this. Each assembly or .dll contains a manifest that list its dependencies by version and token id. The OS dynamically loads the dependencies based on the manifest.

https://en.wikipedia.org/wiki/Side-by-side_assembly

This was introduced in Windows 2000 and used for core OS components starting with Windows Vista.

I think Guix has the potential to do that. At least the hash for the reproducible build is part of the package definition.

So it seems like one should be able to just have that hash, and then rely on the backend to just go fetch a blob that has that hash from a list of possible sources (centralized repo, bittorrent tracker, IPFS, etc.)

Why use hashes instead of, e.g., semver, or hash + patch version, so that you could patch Heartbleed easily?

What do you mean should be hashed? Each library?

Yes. Then add a service on the OS that fetches the libraries for any binary. It's not a complicated thing. It's been obvious to me for years that this is how exact version linking should work.

Linux at least has library versioning so this is less of a problem. Windows has foo.dll and foo.dll and foo.dll, so pretty much the only way is to ship your own foo.dll.

There are schemes like this, e.g. Nix.

I like it though it not without any disadvantage.

It will be challenging to upgrade OpenSSL after a discovered vulnerability.