fair point. I think you *might* approve of Deno and Nix since they at least check that the hash matches the version in the lockfile?
at any rate, Hunchentoot is kinda important to what i want to do and it has like a dozen other dependencies that I would have to build myself if I don't use quicklisp. :/