There is no way to re-fetch or invalidate old versions of providers+modules

[Yantrio]

Right now the registry only fetches new items whenever it does a refresh, and we have no process in place right now to invalidate releases.

To Discuss: Should we assume that the registry entries are immutable in the future? or should we introduce a process to revoke/remove versions?

[virtualroot]

I vow for immutable, as SemVer Specification states

Once a versioned package has been released, the contents of that version MUST NOT be modified. Any modifications MUST be released as a new version.

This will lower the workload around the registry, with the only exception being security-related, like removing a hijacked provider that distributes malware.

This conversation relates to the policy issue #68.