A new thing for Node.js & Javascript
summary
A proposal to replace centralized npm with Entropic describes a working federated registry: a client and server, package mirroring on demand, content-addressable storage, and package and metadata public-key signing so mirrors verify provenance. The repo and slides live at the uploader’s links; an initial instance and sync protocol exist from a five‑week prototype and stalled summer ramp, and goals include operator targets like <$5/month for tiny instances and ~$50 for larger ones and a public-key signed ledger for instance discovery and trust.
AI-written summary · about
chapters (20)
- 0:00Intro
- 2:14Trust
- 3:46Why does this power exist
- 4:26What constraints make a packaged registry successful
- 7:13Why we worry
- 7:53NPM 2019
- 8:59Entropic
- 10:00Decentralized registries
- 12:43Public key cryptography
- 14:01Content addressability
- 15:16Content hashes
- 16:48What happened
- 18:06Making decisions
- 19:07Lessons learned
- 20:34Need help
- 21:14Our ultimate goal
- 22:04tropic registries
- 22:50what happens if we fail
- 23:46the mission
- 24:19Wrap up
related talks
39mnpm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem
22m#unpublish Happens — How to protect your Node.js Investment
32mBeyond npm Install...
31mnpm: paster, presenter, futurer
06mJavaScript and npm and what now
42mPACKAGES FOR MASS CONSUMPTION - AN NPM STORY UNFOLDED
28mHow npm Works
37mNode.js Package Maintenance...