JRFC 19 - Let's Stop Installing Packages #19
Description
Today's paradigm includes installing software. It's really silly, having to go find a particular package, and then download it manually. Our package managers should just make the code available. If it can be found in the registry, it should be importable in the code.
How?
Easy, mount the registry:
/npm/<module-name>/<version>
Or, in my world:
/ipns/npmjs.org/<module-name>@<version>
Concerns
What about Security? is this safe!?
Security is not about installing software X at time Y, but about checking integrity (hash the code) and authenticity (sign the code). This could be done on import, every single time you run the code, which would be much safer than just hoping all your files are the same as when you last looked at them. You did look at all the modules you imported, right? You are sure that foobar module you used doesn't actually open a back door, right?
But what about production? Will I have to randomly download modules?
Not at all, things will be cached locally, and just make sure things stay local, why not pin them?
> mounted-npm pin module-i-care-about
Basically, make your "mounted registry" save things locally that you're going to use regularly. (IPFS will do this for you).
But, maybe I want to version lock?
And you should! Lock your local files to exactly the modules you want:
> echo bar@1.3 >> modules-i-want
> echo foo@1.0 >> modules-i-want
> cat modules-i-want | mounted-npm lock
> mounted-npm ls
bar@1.3
foo@1.0