A minimal, trustless, declarative package and configuration manager