5 ms·

What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs https://github.com/ipfs/ipfs

by cookrn 11y ago

smaddox 11y ago
I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.
- nikolay 11y ago
  No signatures, no (at least!) an IPFS mirror as a backup option - how can one trust NPM or the likes?!
- kylecordes 11y ago
  NPM doesn't even have immutable versions. Many would love to see this improved.
  - jakub_g 11y ago
    What you mean by that? It used to be possible to republish a version (it broke our build when a dep was republished with a breaking change, that's how I learnt about it) but this was fixed some 2-3 years ago IIRC
- viraptor 11y ago
  As much as I agree, IPFS is still very much under construction and I don't think any known package managers got started after IPFS was reliable. You can experiment with ipfs-backed git remotes though. That's already possible.
  - jplur 11y ago
    Yes the IPFS implementation might change but not the content multihash addressing. Linking to data with those addresses is the generic 'package management' that solves all these problems (references to mutable data at mutable origins, circular dependencies, data caching, namespace conflicts). The specifics of resolving links will hopefully be something we don't think about much. I've played around with ipfs.js for resolving links into eval'd js at runtime and imagine a npm replacement would be pretty trivial. The IPFS peer to peer swarm seems stable to me but you could also dump all your hash-named files into a s3 bucket or something as a fallback repo.
  - noffle 11y ago
    gx is a generic package manager on top of IPFS that uses git-style hooks for adding per-language support. It's already being used to manage dependencies on the go-ipfs project: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx Bonus: there's also a IPFS git remote implementation! https://github.com/cryptix/git-remote-ipfs https://github.com/cryptix/git-remote-ipfs
Ericson2314 11y ago
Somewhat related, I just coincidentally stumbled upon https://github.com/alexanderGugel/ied https://github.com/alexanderGugel/ied . "Upcomming Nix-inspired features", to paraphrase their README, could well prevent this debacle. (And btw, We Nix users very much do hope to start using IPFS :).)
gritzko 11y ago
Git has crypto for a reason. Every package manager must have it too.
ArneBab 11y ago
There’s already apt-get over Freenet: http://127.0.0.1:8888/freenet:USK@oRy7ltZLJM-w-kcOBdiZS1pAA8P-BxZ3BPiiqkmfk0E,6a1KFG6S-Bwp6E-MplW52iH~Y3La6GigQVQDeMjI6rg,AQACAAE/deb.mempo.org/64/#install_apt_freenet http://127.0.0.1:8888/freenet:USK@oRy7ltZLJM-w-kcOBdiZS1pAA8...
niutech 11y ago
There is already gx package manager: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx

What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs https://github.com/ipfs/ipfs

by cookrn 11y ago

What if such a system was implemented using IPFS[0] (or similar) for storage? [0] https://github.com/ipfs/ipfs https://github.com/ipfs/ipfs

smaddox 11y ago

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.

nikolay 11y ago
No signatures, no (at least!) an IPFS mirror as a backup option - how can one trust NPM or the likes?!
kylecordes 11y ago
NPM doesn't even have immutable versions. Many would love to see this improved.
- jakub_g 11y ago
  What you mean by that? It used to be possible to republish a version (it broke our build when a dep was republished with a breaking change, that's how I learnt about it) but this was fixed some 2-3 years ago IIRC
viraptor 11y ago
As much as I agree, IPFS is still very much under construction and I don't think any known package managers got started after IPFS was reliable. You can experiment with ipfs-backed git remotes though. That's already possible.
- jplur 11y ago
  Yes the IPFS implementation might change but not the content multihash addressing. Linking to data with those addresses is the generic 'package management' that solves all these problems (references to mutable data at mutable origins, circular dependencies, data caching, namespace conflicts). The specifics of resolving links will hopefully be something we don't think about much. I've played around with ipfs.js for resolving links into eval'd js at runtime and imagine a npm replacement would be pretty trivial. The IPFS peer to peer swarm seems stable to me but you could also dump all your hash-named files into a s3 bucket or something as a fallback repo.
- noffle 11y ago
  gx is a generic package manager on top of IPFS that uses git-style hooks for adding per-language support. It's already being used to manage dependencies on the go-ipfs project: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx Bonus: there's also a IPFS git remote implementation! https://github.com/cryptix/git-remote-ipfs https://github.com/cryptix/git-remote-ipfs

Ericson2314 11y ago

Somewhat related, I just coincidentally stumbled upon https://github.com/alexanderGugel/ied https://github.com/alexanderGugel/ied . "Upcomming Nix-inspired features", to paraphrase their README, could well prevent this debacle. (And btw, We Nix users very much do hope to start using IPFS :).)

gritzko 11y ago

Git has crypto for a reason. Every package manager must have it too.

ArneBab 11y ago

There’s already apt-get over Freenet: http://127.0.0.1:8888/freenet:USK@oRy7ltZLJM-w-kcOBdiZS1pAA8P-BxZ3BPiiqkmfk0E,6a1KFG6S-Bwp6E-MplW52iH~Y3La6GigQVQDeMjI6rg,AQACAAE/deb.mempo.org/64/#install_apt_freenet http://127.0.0.1:8888/freenet:USK@oRy7ltZLJM-w-kcOBdiZS1pAA8...

niutech 11y ago

There is already gx package manager: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx