Software library versioning with caching

A system, comprising:

• a client computing device;
• and
• instructions executable in the client computing device, wherein when executed the instructions cause the client computing device to at least:
• request a library in response to a first dependency in a first network resource, the first dependency requiring a version of the library;
• receive in a first download the library together with a signature that identifies the version of the library and a public key capable of verifying the signature, the public key being chained to a trusted certificate pinned by the client computing device, and a cost being attributed to a first entity associated with the first dependency based at least in part on the first download;
• verify an authenticity of the public key using the trusted certificate pinned by the client computing device;
• execute a cryptographic hash function using the public key as an input to the cryptographic hash function to obtain a hash value;
• verify an authenticity of the library by comparing the hash value with the signature;
• store the library in a local cache on the client computing device, the local cache being indexed by respective library signatures;
• determine that a second network resource has a second dependency on the library;
• determine that the second dependency specifies the library having a same signature;
• request a signature file in response to the second dependency;
• receive the signature file associated with the second dependency;
• and
• load the library from the local cache in response to the second dependency specifying the library having the same signature, thereby avoiding a second download of the library, a portion of the cost attributed to the first entity being reattributed to a second entity associated with the second dependency based at least in part on the second download being avoided.

A method, comprising:

• requesting, via at least one of one or more computing devices, a library via a network in response to a first dependency in a first client application, the first dependency requiring a version of the library;
• receiving, via at least one of the one or more computing devices, in a first download, the library together with a signature that identifies the version of the library and a public key capable of verifying the signature, the public key being chained to a trusted certificate pinned by the first client application and a second client application, and a cost being attributed to a first entity associated with the first dependency based at least in part on the first download;
• verifying, via at least one of the one or more computing devices, an authenticity of the public key using the trusted certificate pinned by the first client application and the second client application;
• executing, via at least one of the one or more computing devices, a cryptographic hash function using the public key as an input to the cryptographic hash function to obtain a hash value;
• verifying, via at least one of the one or more computing devices, an authenticity of the library by comparing the hash value with the signature;
• storing, via at least one of the one or more computing devices, the library in a local cache, the local cache being indexed by respective library signatures;
• determining, via at least one of the one or more computing devices, that the second client application has a second dependency on the library;
• requesting, via at least one of the one or more computing devices, a signature file via the network in response to the second dependency;
• receiving, via at least one of the one or more computing devices, the signature file associated with the second dependency;
• determining, via at least one of the one or more computing devices, that the second dependency specifies the library having a same signature;
• and
• loading, via at least one of the one or more computing devices, the library from the local cache in response to the second dependency specifying the library having the same signature, thereby avoiding a second download of the library, a portion of the cost attributed to the first entity being reattributed to a second entity associated with the second dependency based at least in part on the second download being avoided.