A Protocol for Package Management
Summary
Andrew Nesbitt proposes a high-level reference model for package management that abstracts away ecosystem-specific details to compare resolutions, governance, and distribution. The piece outlines layers, actors, data types, operations, consistency properties, data flow patterns, and failure modes, and discusses potential benefits for security research and cross-ecosystem tooling. It also clarifies that this is not a standard to force convergence, but a shared vocabulary to improve understanding and interoperability.