Universal Package Registry

[mikeal]

What if we built a more decentralization friendly version of libraries.io?

A universal package registry that would:

• Collect meta-data in realtime from all known package managers.
• Produce feeds of signed data about all packages you could replicate offline.
• For every version of every package it would also point to the CID for the IPFS version of the package tarball.

Doing this in a neutral way that isn't specific to any single package manager would make it a great resource for anything we want to try and build for a specific package manager and its community in the future. We could also probably build a solid community of contributors since the data itself would be open and quite useful to lots of people.

[daviddias]

@mikeal https://github.com/ipfs/notes would be ideal venue for this proposal. Wanna move it there?