code.dlang.org name collision

[Steven Schveighoffer]

I think currently on code.dlang.org, if you create a library/program for 
use, it uses the name you choose as a unique identifier for your project.

However, this seems rather open to abuse, or to unnecessary conflicts.

An example, I plan to have iopipe depend (eventually) on Martin Nowak's 
new io library listed here:

https://github.com/MartinNowak/io

But, there is already an "io" library in dub:

http://code.dlang.org/packages/io

This links to a stale project, https://github.com/jasonwhite/io, not 
updated since June 2016.

So what does this mean? Jason White's library gets to own the name "io" 
forever?

It's not fair to Jason, or anyone who links to his project to take it 
down or change it, but this also seems unfair to anyone who is willing 
to publish and maintain an io package of their own.

One of the most annoying things I found is that even if I add-local 
Martin's io repository to dub, it *still* wants to compile against the 
code.dlang.org library (this makes sense as we don't want hijacking, but 
the solution sucks, I have to use a modified version of Martin's dub.sdl 
file).

Regardless of this example, I'm sure you can see the dilemma here. 
Should we have an application/approval process for package names? Should 
we allow the same named packages on dub, but provide a way to 
disambiguate when specifying dependencies? Other ideas?

What do you all think?

-Steve

P.S. maybe there is already a solution in place for this, but I'm not 
seeing it.