I should send a PR that applies the tariffs randomly and sometimes arbitrarily changes the numbers…
I might even make it so, that it calculates an import deficit by looking at how often your libraries are imported in the codebase of the projects, that the maintainers of your dependencies have vs. the number of imports your code has from them.
And a blockchain helps to solve which part of the problem? Some were working on mirroring all data to a git repository. In theory, that allows for easy access on all the data, versioning (with commits) and - through forks and merge requests - collaboration and distribution. Also git is a distributed repository that clones the whole history to your local drive.
https://github.com/MITRE-Cyber-Security-CVE-Database/mitre-cve-database
But with the announcement of the cve foundation, I don’t know whether they will really import all the data in this git repository.