JRFC 19 - Let's Stop Installing Packages

Today's paradigm includes _installing_ software. It's really silly, having to go find a particular package, and then _download_ it manually. Our package managers should just make the code available. If it can be found in the registry, it should be importable in the code.
## How?

Easy, mount the registry:

```
/npm//
```

Or, [in my world](https://github.com/jbenet/ipfs):

```
/ipns/npmjs.org/@
```
## Concerns

> What about Security? is this safe!?

Security is not about installing software X at time Y, but about checking integrity (hash the code) and authenticity (sign the code). This could be done _on import_, every single time you run the code, which would be much safer than just hoping all your files are the same as when you last looked at them. You _did_ look at all the modules you imported, right? You are _sure_ that `foobar` module you used doesn't actually open a back door, right?

> But what about production? Will I have to randomly download modules?

Not at all, things will be cached locally, and just make sure things stay local, why not pin them?

```
> mounted-npm pin module-i-care-about
```

Basically, make your "mounted registry" save things locally that you're going to use regularly. (IPFS will do this for you).

> But, maybe I want to version lock?

And you should! Lock your local files to _exactly_ the modules you want:

```
> echo bar@1.3 >> modules-i-want
> echo foo@1.0 >> modules-i-want
> cat modules-i-want | mounted-npm lock
> mounted-npm ls
bar@1.3
foo@1.0
```

Start with the proposed registry paths `/npm//` and `/ipns/npmjs.org/@`, then review the `mounted-npm` commands for pinning, locking, and listing modules. Done would require a defined implementation for registry mounting, caching, integrity and authenticity checks, and version locking.

Written by the indexing model from the issue text.