That's a total overkill for the purpose. We use signatures for authenticity checks. Let's not try to use Ethereum for everything just because we hold some ETH and want its value to grow by using it where it's not even necessary.
Which means I have to look up the signature every time, and which point I might as well just install using the github repo. The fact that pretty much nobody uses that workflow today tells you something.
If its the token that bothers you, run this off the main chain with the transaction cost set to 0. No ether necessary.
- a package got unpublished - we demand an immutable package manager;
- packages got hijacked - we need authenticity as basic as checksums or signatures.
Anything that accomplishes the above in an uncomplicated manner will win my business. Any craptocurrency pitching will not.
> gx supports named packages via user configured repositories. A repository is simply an ipfs object whose links name package hashes. You can add a repository as either an ipns or ipfs path.
It doesn't solve the repository "discovery" problem, but it does seem conceptually much simpler than trying to use a cryptocurrency-based solution.