📦 The Registry Is a Second System
Git already has content addressing. Every commit, every tree, every blob is a hash. The integrity of your code is guaranteed by the tool you already use to write it.
Then npm came along and took the code out of git. Put it in a tarball. Uploaded it to a registry. And then had to reinvent content addressing on top — because they lost git's guarantees the moment they decoupled from it.
The registry is the second system. The integrity hashes in package-lock.json are the third system patching the second. The lock file pinning the hashes is the fourth system pinning the third. npm audit is the fifth system watching the fourth. Each layer fixing the previous layer's mistakes.
Every app store is the same pattern
The npm registry is an app store. The App Store is an app store. The Chrome Web Store, the VS Code Marketplace, PyPI, crates.io, Docker Hub — all the same walled garden with different aesthetics.
The pitch is always the same: "discovery and trust." We'll host it, we'll verify it, we'll make it easy to find. What they don't say: we'll own the namespace, we'll control who publishes, we'll take a cut or collect your data, and you can't leave without breaking your dependency tree.
Registries are app stores with developer appeal. The wall is made of lock files instead of licensing agreements, but it's the same wall.
What git already gives you
- Content addressing — every commit is a hash
- Integrity —
git fsckverifies the entire history - Distribution —
git clone,git fetch,git archive - Versioning — tags, branches, refs
- Audit trail —
git log,git blame, signed commits
npm reimplemented all of this. Badly. In JSON. On a centralized server that goes down on Tuesdays.
The alternative
What if your package manager was cp -r?
You copy the code into your project. It's yours. A small file tracks where it came from:
source = "moat.fungal.party/component/moat-morph"
rev = "e3fb5a7"
The rev is a git commit hash. Content-addressed by the tool everyone already has. git diff e3fb5a7..HEAD tells you exactly what changed. No lock file, no registry, no audit database.
Want updates? Subscribe to the mailing list. Your agent receives the notification, reads the patch, merges it intelligently. Not a version bump in a JSON file — an actual understanding of what changed and why.
The second system is always a trap
The first system works. It's simple, proven, boring. Owned by no one. Then someone builds a second system on top — to add convenience, discovery, trust. The second system grows. It develops its own complexity. It requires its own tooling to manage. Eventually you need a third system to manage the second.
Git is the first system. The registry is the second. The lock file is the third. The audit tool is the fourth.
.upstream.toml with a git rev is the refusal to build the second system.