on separate note, why don't registry like npm take a raw repo and build in some kind of reproducible environment (like nixos/or even standardized docker ) then

on separate note, why don't registry like npm take a raw repo and build in some kind of reproducible environment (like nixos/or even standardized docker ) then user uploading pre built package is beyond me. i think fdroid does sth like that. i think it will help with a lot with different supply chain attack. (not this one though). native extensions (c++) will be pain though, but with the advent of wasm maybe native extensions are not that great idea now huh ¯\_(ツ)_/¯