In the bad old days when software shipped in boxes, one of the most important roles on a software team was that of "Build Master". The holy grail was reproducib

In the bad old days when software shipped in boxes, one of the most important roles on a software team was that of "Build Master". The holy grail was reproducible builds that generated identical binary build artifacts. This was achieved with two principles: 1. Identical toolchain. 2. Identical dependencies. These two principles still apply, at least for the toolchains that produce binary/bytecode/bitcode artifacts, and we have much better tools to achieve these goals. Since VMWare became popular, virtual machines have made the goal of maintaining identical toolchains trivial: we simply maintain snapshots of the machine image used for the builds. The Web, or more specifically the HTTP transport, has made dependency management infinitely better. The Web has changed the world but it seems that the software development community has not imbibed the RESTful principles described by Roy Fielding. URLs, especially for software dependencies, should be forever. Support for URL forwarding should be a requirement for package repositories. I am also flummoxed that the Cache-Control and Concurrency-Control built into HTTP is not leveraged. We have conditional requests that use ETag or Last-Modified headers and the Content-MD5 header has been part of HTTP for a long time. As far as I am aware, Software Configuration Management tools tend to do the same thing out-of-band. ETags are opaque, but if I was designing a new package repository, my ETag would be the SemVer, optionally annotated with the target architecture for binaries.