Growing community and namespace collisions

@leafo regarding Olivine-Labs/lua-jwt#4

I'm noticing more frequent dependency management issues using luarocks. Right now it seems too easy to break downstream projects from accidental namespace collisions. I'm not sure that the current luarocks implementation creates an opportunity to fix this. The purpose of this issue is to generate a dialog for creating proposal for a more long term fix.

Would you/luarocks be open to the idea of namespace enforcement? For example:

Phase 1 might be to create a static blacklist table to reject rock submissions that declare modules that are known and 'generic' to the community at large? A good example of this is the cjson module. In the last week I've counted 5 different variants. Some implement different functionality but do not have other widely accepted upstream patches. This is causing a lot of harm to the community imho.

Phase 2 might be index declared module namespaces of existing rockspecs and reject submissions that collide. Prompting the developer to be more thoughtful about his/her naming scheme. If outright rejection is not desirable, maybe we can patch luarocks to warn the developer of this conflict before submission? I think this is an easy mistake to make. Other packaging methods (most notably python packages) generally assume that the package name influences the namespace in some way. The differentiation between package and module namespace in luarocks is a bit confusing.

Phase 3 might be to adopt a rockspec naming scheme that mimics github and more recently dockerhub. Something like 'developer/package:version_tag'. This seems beneficial in the long term because it paves the way to adopt semantic versioning as a standard in the lua community and allows developers who are forking existing modules to be clearly differentiated.

These are just off the top of my head. I don't even know if luarocks can support args in the format proposed in phase 3.

Start by reviewing LuaRocks' dependency, rockspec, and module-namespace handling; the issue does not identify files, tests, or an implementation entry point. Compare the proposed blacklist, collision warning or rejection, and namespaced rockspec approaches, then define an agreed proposal and acceptance criteria before implementation.

Written by the indexing model from the issue text.