Every new language eventually needs a package manager. Ours is no different - but we made one unusual choice: total independence from npm, pip, crates.io and friends.
It is called MsrfPM, and it ships packages for our programming language across backend, frontend, OS, robotics and IoT targets.
Why not just use npm?
Our language compiles to web (WASM), native executables (ELF64/PE32+) and embedded boards. A JavaScript-based registry cannot express "this package has a native ARM build and a WASM build and a checksum per target". We needed:
- Per-target metadata - one package, many compiled artifacts
- SHA-256 integrity on every artifact - verified at install time, not just download time
- Zero runtime dependencies - MsrfPM itself is a standalone binary; no Node, no Python required to bootstrap your toolchain
How publishing works
- Build your package (the compiler emits per-target artifacts)
-
msrfpm publish- hashes every artifact, uploads, updates the registry index - Consumers run
msrfpm install <pkg>- integrity is verified before anything touches disk
The honest trade-off
Independence means starting an ecosystem from zero. npm has 2 million packages; we have a handful. The bet: for edge and IoT targets where npm cannot follow, a registry that speaks per-target artifacts natively is worth more than a million JavaScript packages.
Part of a free single-sign-on developer platform - registry and tools live at https://msrfteam.com/msrfpm
If you have built registry infrastructure before - what would you do differently? We are one year in and still learning in public.
Top comments (0)