think through how to download package dependencies

[BrianHicks]

Lots of languages I've used (Ruby, Elm, Python, Rust) have a single manifest file (sometimes with a lock file) to define all the dependencies and versions needed for a project. In a lot of cases, we're just going to want to leave this alone and call (e.g.) pip install with the manifest and lock files as targets. But in certain cases, we may be able to take over some of the downloading and installing. (For example, look at all the x2nix packages out there!)

So, in the case where we can download a bunch of files, we probably want to cache those—how? Does the cache need to be mutable? In what cases? Can we avoid having a shared mutable state escape hatch altogether while still supporting these use cases?