3 ms·
Ignoring the payment bits, I feel like package indexing could be a decent use of a distributed append-only public datastore. You need a list of packages, and n
by SAI_Peregrinus 5y ago
Ignoring the payment bits, I feel like package indexing could be a decent use of a distributed append-only public datastore.
You need a list of packages, and new versions shouldn't prevent finding older versions, so an append-only system makes sense.
You want to allow anyone to upload packages, not just a blessed list of maintainers, but need to be able to authenticate that new versions were uploaded by the same entity as the previous version, so a decentralized trust system makes some sense.
So some sort of blockchain makes sense. On the downside it's almost certainly going to be more expensive, get filled with junk packages made by "maintainers" who aren't the original authors, and cause confusion about which packages are actually trustworthy.
Like Namecoin, I think it's a viable use of a blockchain (other than the usual three of speculation, separating fools from their money, and evading laws around money). Like Namecoin, I doubt it'll end up going anywhere because the advantages of the system aren't that big compared to the disadvantages.
- soraminazuki 5y agoYou need git.
- SAI_Peregrinus 5y agoGit isn't quite a blockchain, since it's a DAG and doesn't have a distributed consensus algorithm built in, while a "true" blockchain would be a Merkle tree with a built-in consensus algorithm. But it's very close, and by skipping the "coin" part of a cryptocurrency it manages to be far more useful.
- verdverm 5y agoYou might like Sigstore / Cosign which is seeing rapid adoption. It has an append only ledger for package signatures and does not car where the package lives or how it is distributed. The package and distribution tools are adopting it to help secure the software supply chain.