Distributed Software Dependency Management Using Blockchain

Contemporary software deployments rely on cloud-based package managers for installation, where existing packages are installed on demand from remote code repositories. Usually frameworks or common utilities, packages increase the code reusability within the ecosystem, whilst keeping the code base small. However, disruptions in the package management services can potentially affect development and deployment workflows. Furthermore, cloud package managers have arguably an ambiguous ownership model and offer limited visibility of packages to the users. This work describes the development of a blockchain-based package control system which is decentralised, reliable, and transparent. Blockchain nodes are installed within the distributed infrastructure to provide immutability, and then a dependency graph is constructed with the help of smart contracts to trace the software provenance. Our system has been successfully tested with 4338 packages from NPM, 950 out of which are the top depended-upon packages.