You might take a look at how Go implemented their module system and solves the above without blockchain or a lockfile. Simple algo, excellent engineering, built in security and integrity checking.

In the end, you will want to mirror all external dependencies (repos, git, pkg) into your own cloud.

So Demo has us specify versions at the point of import, in how many files? Is this lunacy?

I store more files on GitHub for free, how can blockchain be cheaper than that?