5 ms·

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provide

by smaddox 11y ago

I'm surprised all package managers don't use an IPFS-like system that uses immutable state with mutable labels and namespaces. Now that IPFS exists, and provides distributed hosting, it's even easier.

nikolay 11y ago
No signatures, no (at least!) an IPFS mirror as a backup option - how can one trust NPM or the likes?!
kylecordes 11y ago
NPM doesn't even have immutable versions. Many would love to see this improved.
- jakub_g 11y ago
  What you mean by that? It used to be possible to republish a version (it broke our build when a dep was republished with a breaking change, that's how I learnt about it) but this was fixed some 2-3 years ago IIRC
viraptor 11y ago
As much as I agree, IPFS is still very much under construction and I don't think any known package managers got started after IPFS was reliable. You can experiment with ipfs-backed git remotes though. That's already possible.
- jplur 11y ago
  Yes the IPFS implementation might change but not the content multihash addressing. Linking to data with those addresses is the generic 'package management' that solves all these problems (references to mutable data at mutable origins, circular dependencies, data caching, namespace conflicts). The specifics of resolving links will hopefully be something we don't think about much. I've played around with ipfs.js for resolving links into eval'd js at runtime and imagine a npm replacement would be pretty trivial. The IPFS peer to peer swarm seems stable to me but you could also dump all your hash-named files into a s3 bucket or something as a fallback repo.
- noffle 11y ago
  gx is a generic package manager on top of IPFS that uses git-style hooks for adding per-language support. It's already being used to manage dependencies on the go-ipfs project: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx Bonus: there's also a IPFS git remote implementation! https://github.com/cryptix/git-remote-ipfs https://github.com/cryptix/git-remote-ipfs

by smaddox 11y ago

nikolay 11y ago

No signatures, no (at least!) an IPFS mirror as a backup option - how can one trust NPM or the likes?!

kylecordes 11y ago

NPM doesn't even have immutable versions. Many would love to see this improved.

jakub_g 11y ago
What you mean by that? It used to be possible to republish a version (it broke our build when a dep was republished with a breaking change, that's how I learnt about it) but this was fixed some 2-3 years ago IIRC

viraptor 11y ago

As much as I agree, IPFS is still very much under construction and I don't think any known package managers got started after IPFS was reliable. You can experiment with ipfs-backed git remotes though. That's already possible.

jplur 11y ago
Yes the IPFS implementation might change but not the content multihash addressing. Linking to data with those addresses is the generic 'package management' that solves all these problems (references to mutable data at mutable origins, circular dependencies, data caching, namespace conflicts). The specifics of resolving links will hopefully be something we don't think about much. I've played around with ipfs.js for resolving links into eval'd js at runtime and imagine a npm replacement would be pretty trivial. The IPFS peer to peer swarm seems stable to me but you could also dump all your hash-named files into a s3 bucket or something as a fallback repo.
noffle 11y ago
gx is a generic package manager on top of IPFS that uses git-style hooks for adding per-language support. It's already being used to manage dependencies on the go-ipfs project: https://github.com/whyrusleeping/gx https://github.com/whyrusleeping/gx Bonus: there's also a IPFS git remote implementation! https://github.com/cryptix/git-remote-ipfs https://github.com/cryptix/git-remote-ipfs