CJ Silverio, who left the position of Chief Technology Officer at NPM Inc. at the end of last year, the new package repository , which is being developed as a distributed alternative to NPM, not controlled by any specific company. The Entropic code is written in JavaScript and is licensed under Apache 2.0. The project has been developing for just a month and is at an initial prototype stage but already supports basic operations such as connecting, publishing, and installing packages.
The reason for creating Entropic is cited as the complete dependence of the JavaScript/Node.js ecosystem on NPM Inc., which controls the development of the package manager and the maintenance of the NPM repository. A situation has arisen where a profit-driven company solely controls a system upon which millions of developers and JavaScript applications depend, processing billions of package downloads each week.
Recent layoffs, changes in leadership, and NPM Inc.'s courting of investors have created a sense of uncertainty regarding the future of NPM and distrust that the company will prioritize community interests over those of investors. According to Silverio, NPM Inc. cannot be trusted as the community has no leverage to hold it accountable for its actions. Moreover, the profit-oriented focus hampers the implementation of primary community-oriented but non-revenue-generating capabilities that require additional resources, such as support for digital signature verification.
Silverio also doubts that NPM Inc. is interested in optimizing its backend interactions, as this would reduce data flows that might be monetizable. Each time the command “” is run, the contents of the file , which includes a lot of interesting information about what the developer is doing, are exposed. In response, several prominent members of the JavaScript/Node.js community have begun developing an alternative that is not controlled by any specific companies.
The Entropic system uses the principle of a federated network, where a developer can deploy a server with a repository of the packages they use on their own resources and connect it to a shared distributed network that unifies disparate private repositories. Entropic allows for the coexistence of multiple repositories, with interaction occurring as part of the usual workflow.
All packages are divided using namespaces and include information about the host where their primary repository is located.
A namespace essentially represents the name of the package owner or a group of maintainers who have the right to release updates. In general terms, the package address appears as 'namespace@repohost.com/pkg-name'.
Metadata and dependency information are defined in the format .
In the case of hosting a package in a local repository that is dependent on packages from other repositories, those packages are mirrored in the local repository. Thus, the local repository becomes self-sufficient and includes copies of all necessary dependencies. There is a layer for interacting with the classic NPM repository, which is processed as a read-only archive. It is also possible to install packages from NPM using locally deployed Entropic environments.
A command-line toolkit is provided to simplify the deployment of repositories within your local network. Entropic offers fundamentally new and storage system that minimizes the amount of data downloaded over the network. Entropic is presented as a universal system that can be used to create repositories for packages in any programming language; however, it is primarily being developed with JavaScript in mind and is best suited for projects in that language.
Source: opennet.ru
