{"id":15437800,"url":"https://github.com/victorb/cowpen","last_synced_at":"2026-07-03T14:01:35.662Z","repository":{"id":148376848,"uuid":"54806390","full_name":"victorb/cowpen","owner":"victorb","description":"CLI for publishing immutable NPM packages/NodeJS modules","archived":false,"fork":false,"pushed_at":"2016-03-27T03:22:09.000Z","size":122,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-22T04:14:39.193Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/victorb.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-03-27T00:56:14.000Z","updated_at":"2018-12-19T20:31:40.000Z","dependencies_parsed_at":"2023-05-19T22:30:49.547Z","dependency_job_id":null,"html_url":"https://github.com/victorb/cowpen","commit_stats":{"total_commits":14,"total_committers":1,"mean_commits":14.0,"dds":0.0,"last_synced_commit":"78761a12cebab877637f9b12e26d811fc50eb2ae"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/victorb/cowpen","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorb%2Fcowpen","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorb%2Fcowpen/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorb%2Fcowpen/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorb%2Fcowpen/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/victorb","download_url":"https://codeload.github.com/victorb/cowpen/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victorb%2Fcowpen/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35088478,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-03T02:00:05.635Z","response_time":110,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-01T18:58:52.504Z","updated_at":"2026-07-03T14:01:35.633Z","avatar_url":"https://github.com/victorb.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cowpen\n\nCLI for publishing immutable NPM packages/NodeJS modules\n\n![cowpen logo](logo.png)\n\n## What is this?\n\nThis is my attempt to solve some issues with NPM by using an immutable filesystem called IPFS. IPFS guarantees that whatever you downloads, will match with the hash you use to download that thing. cowpen is applying this to NodeJS modules.\n\nIt's mostly about being able to store and retrieve packages in a safe way that allows you to have reproducible builds, at all times.\n\n## Problems cowpen is solving\n\n* Don't reinvent everything NPM already solved (don't rewrite the entire CLI)\n* Packages can never just disappears. If you `pin` a package, it'll be there until there is no seeds (similar to Bittorrent).\n* New versions won't change your application, ever.\n* No centralization, which means no one will force you to remove a package.\n* Don't care about politics, just about publishing and reusing other peoples code.\n* Simply how to deal with NodeJS modules in a better way.\n* If you removed a module while being offline, you can easily install it again\n* If the package you're trying to install lives inside your LAN, IPFS will get it from there\n\n## Problems cowpen doesn't care about\n\n* Copyright (If you seed a package, you're responsible for the downfall of seeding it)\n* npm scripts \"vulnerability\" (Downloading code and executing it is literally a package managers job, we're not gonna change that)\n* Politics (We're never gonna delete your package, because we can't)\n\n## Requirements\n\n* NodeJS version 4 or higher\n* NPM version 3 or higher\n* IPFS version 0.3.11 or higher\n* FUSE version 27 or higher\n\ncowpen might work on earlier releases of these programs but it has not been tested so we cannot guarantee anything.\nPlease let us know if it work/doesn't work for you.\n\n## Installation \u0026 Setup\n\n* `ipfs daemon --init --mount`\n* Wait until you see `Daemon is ready` in output\n* `npm install -g cowpen@/ipfs/IPFS-HASH-FOR-COWPEN`\n\nWait, what's the weird @/ipfs/... thing? That's the IPFS part of cowpen.\n\nWhen NPM sees a filepath as the version argument, NPM tries to \"download\" the module from the filesystem instead.\n\nAnd in the first step, you run IPFS with the `--mount` argument, IPFS mounts /ipfs and /ipns to serve content from IPFS.\n\nSo with a little bit of magic, we have installed cowpen with IPFS. Simple huh?\n\n## How do I install modules with this?\n\nYou just use NPM like you're used to, but without shrinkwrap and versions being IPFS hashes instead of semvers.\n\nYou want to install a package and save it in your local project?\nFind out the hash (cowpen will include search in the future) and install it!\n\n```\nnpm install --save lodash@/ipfs/Qmec32NqcZCh83t9QhrfVFnHq9eHSNr389y8z6mSvBabDp\n```\n\nNow it's installed, and with the hash we make sure that you always have the same version installed.\n\nYou want to install all dependencies in a project that is using cowpen?\n\n```\nnpm install\n```\n\nIt couldn't get any easier than this.\n\n## How do I publish a module?\n\nSimple! Just do: (while being in the directory of the package you want to publish)\n\n```\ncowpen publish\n```\n\nAnd cowpen will return you the path you can use for installing your package.\n\nIf you're clever, you include this hash wherever you are doing releases, like a mailing list, Github Release or the Git tag when creating it.\n\nThat way, people who want to use your package via cowpen, can easily find it.\n\n## How do I find new packages?\n\nWell, here is the tricky part. We haven't quite figured out searching yet, but the idea\nis for every user to run their own ipfs daemon, with a keybase account for verifying the publishing...\n\nBut right now, we don't really have a solution for this. Best would be for you to simply\ninclude the hash wherever you do releases currently.\n\n## FAQ\n\n### So what is cowpen really doing?\n\nWell, at this point, not very much. IPFS and NPM is doing the heavy work, cowpen merely brings tools together and helps out a bit.\n\nIn the future, the search will probably be driven by cowpen in some way. But too early to say right now.\n\n### How can I trust a package?\n\nHow do you know that the package is the right one with the right version? Well, you got the hash from somewhere, so you have to trust that somewhere to not trick you. This is a harder problem to solve.\n\n### Should I include my node_modules when publishing a module?\n\nNo, node_modules should not be included when publishing. But you module should be using IPFS hashes as well for it's dependencies.\n\nReason is that NPM makes node_modules flat and if you include node_modules, you lose that.\n\n#### Notes about trust (for cowpen developers)\n\nIf package A publishes version 1 as ABDEF and package B publishes version 1 as ABDEF, what happens?\n\nA package version has to published and signed by the same peer ID as the first version was published as.\n\nSo in this case, publishing by package B would be blocked from cowpen. But what if he simple inserts the hash manually?\n\n## Name\n\nWhat does Cowpen mean? Well, I don't know. The name is taken from a street in Bahamas.\n\n## Support / Help\n\nIf you have any questions, open a Github issue here:\n[github.com/VictorBjelkholm/cowpen/issues/new](https://github.com/VictorBjelkholm/cowpen/issues/new)\n\nor feel free to contact me on Twitter here:\n[@VictorBjelkholm](https://twitter.com/VictorBjelkholm)\n\n## License\n\nThe MIT License (MIT)\n\nCopyright (c) 2016 Victor Bjelkholm\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictorb%2Fcowpen","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvictorb%2Fcowpen","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictorb%2Fcowpen/lists"}