Decentralized Package Manager

Current package managers are centralized and have many reliability issues, like downtime, data getting erased due to error/intentionally and thus whole dependency tree getting affected. This can be however prevented by switching to decentralized servers where there is no availability issues since smart contract can be designed in such a way that it has functions which can only used to create new version but no other functions to delete or change the package, with this the intentional/error deletion is not possible and thus your dependencies are available 24/7 and also no downtime. Also gas fees won't affect much due to the real package contents are stored off-chain and addressed using immutable hash(CID). And tools like nft.storage makes it possible to do that without need to spend any fee.

We have used IPFS along with smart contract to store and make sure the package are immutable once published. We at the first ask user for package name then we ask user for release, this details are stored in smart contract and minted as an soul found NFT. When user creates release as zip file it gets uploaded to IPFS using nft.storage then the hash returned is stored along with release version in smart contract. Once release is done there is no way to change the hash and thus making it immutable by nature. We are not using any centralized backend and using THEGRAPH to index the events and thus making sure the developers are getting there package available at all times.