Dependencies should be fetched directly from VCS

FWIW, Go provides a mechanism to abstract the import source, so you can use a vanity domain under your control that resolves to your host of choice.

People keep replying seeming to miss what makes Go's solution so good. I think it deserves more attention.

In many cases I think it's impossible to avoid the pain that comes with decentralization without defeating the point. It's challenging because certain things are hard to do decentralized so it's easier to just give up and rely on central authorities and components.

When you install Go, it does just that, to some approximation; it will try to fetch from the module proxy first and fall back after that fails. But what makes Go different and more interesting is that you can just turn that off with no consequence. As long as all of the Git hosts are up, you can still use Go just fine with no proxy. I'm pretty sure Nix builds do this by default with Go so I believe most dependencies are usually online. That means the proxy approach and the decentralized approach are both fully redundant with eachother, while allowing the decentralized VCS hosts to remain the source of truth.

Go also separately has the sumdb to enforce immutability, so you can know that when you go grab a specific package that the tag name corresponds to one and only one exact source code. This is also optional, and even without it you get the benefit of local sum checking via your own cache and go.sum files in source checkouts. But having this be separate is great because it also means you could use another third party module proxy or a third party sumdb, or use just the sumdb and no proxy. It gives you many options to not have to rely on a single party while still getting some of the benefits of centralization.

Systems like this are rare. Many systems try very hard to have the cake and eat it too, but it usually fails somewhere. For me Go's approach works, and that is worth some attention.

Not sure this is the right solution for 2 reasons:

First, I'm uncomfortable with making a package creator's VCS provider part of the language's module infrastructure.

Second, not all files under version control necessarily belong in a tarball, and not all files in a tarball necessarily need to be under version control.

However, the point that there should be an easy way to track changes in your dependencies is well taken. One possible approach would be that publishing a packge boils down to importing the files that normally would go in your tarball into a community-controlled VCS.

2nd paragraph of blogpost:

> A hash of all files is checked against known hashes on sum.golang.org to prevent tags from being replaced, and it uses a proxy to prevent repos from being left-pad’d.

there is no need for 3rd party hosts to stay online. It's the best combination of de-centralized and centralized approaches.

Re pre-buiild packages: Python makes a difference between source and binary wheels. This approach is obviously for source wheels only.

IIRC Go had to deal with a bunch of issue related to their initial source based package management system. The URL imports remain, but I believe fetches are served through the pkg.go.dev proxy now.

Andrew Nesbitt has a good write [0] up on why using Git as a database is a bad idea

[0] https://nesbitt.io/2025/12/24/package-managers-keep-using-gi...