<story><title>Package managers should be immutable, distributed and decentralized</title><url>https://evertpot.com/npm-revoke-breaks-the-build/</url></story><parent_chain></parent_chain><comment><author>Mithaldu</author><text>Asking for Immutable &amp;#x2F; Append-only is insanity, due to the fact that eventually someone WILL clutter the hell out of it, which all of your mirrors will hate you for, as well as downstream ecosystem toolchains. The only viable way to allow it is by vetting every upload, and uh, good luck finding volunteers for that.&lt;p&gt;Decentralized &amp;#x2F; Distributed is a good thing to have and prior art already exists.&lt;p&gt;Source: Experience with the grand daddy CPAN.</text></comment>
<story><title>Package managers should be immutable, distributed and decentralized</title><url>https://evertpot.com/npm-revoke-breaks-the-build/</url></story><parent_chain></parent_chain><comment><author>sorpaas</author><text>Nix (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;nixos.org&amp;#x2F;nix&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;nixos.org&amp;#x2F;nix&lt;/a&gt;), probably?</text></comment>