3 ms·
You should briefly think how opam does updates currently: a repository on GitHub where developers submit their pull requests. This won't change too much. Guara
by hannesm 11y ago
You should briefly think how opam does updates currently: a repository on GitHub where developers submit their pull requests. This won't change too much.
Guarantees are: if a new package from a new developer is submitted, basically none. The signing of delegation and developer keys (by repository maintainers) enables a web-of-trust style system: once package `foo` has been claimed by the well-known (and signed) developer `alice`, there's no way that `eve` will successfully update `foo` (without getting `alice` key, and also then need to go via GitHub and repository maintainers).
- justinsb 11y agoUnrelated to my reservations about this system, I think the idea of computation combined with a git datastore is very interesting and possibly more generally applicable. I like the idea that the snapshot bot enforces additional guarantees on the evolution of the repository, like the ones you're describing here.
- amirmc 11y agoOff-topic but have you come across Irmin? It seems like something you might be interested in. https://mirage.io/blog/introducing-irmin https://mirage.io/blog/introducing-irmin
- justinsb 11y agoThat's the sort of thing I'm very interested in - thanks for the link. I'm particularly interested in doing this actually over git, so the mapping to git is great (as you can probably infer, I think there are big advantages to leveraging existing "devil you know" systems!)