> One reason why it is actually not a good idea to have library names
> like (github.com/gambit/examples hello) just occurred to me:
>
> If, at some point, an author decides to move their repositories from,
> say, GitHub to GitLab or Codeberg, or Savannah (which can be due to
> political reasons or because some repository provider ceases to
> exist), the names of this author's libraries would no longer reflect
> where they can be found.  While this would not harm the functionality
> of the libraries, it would confuse users (who like to click on the
> auto-formatted links in their editors) and loaders that pull source
> code directly from the internet.  Of course, the libraries could be
> renamed, but this should only become necessary if a new version of the
> library becomes gravely incompatible with the previous version.
>
> Making a library name dependent on a location thus clashes with its
> primary use of giving a (universal) name to a particular library.  In
> other words, it makes sense to base a library name on a URN, but not
> on a URI.

Strongly agreed.

The internet is not as stable as its early history has led people to
believe. There are fundamental political and commercial pressures
against the preservation of content at a stable address. The net became
popular after the fall of the Soviet Union and has not yet had to
withstand the kinds of geopolitical shocks that are coming in the next
couple of decades. It's a miracle if we make it without serious outages,
splintering, and persistent ownership disputes and attacks of all kinds.

> What's missing is a connection between URN
> and URI, which should not be part of the library definition by the
> above reasoning.  It belongs to some metadata outside of the library;
> this necessary metadata can also contain some solutions for security
> issues.

Agreed.

Ascertaining the origin of a library is complicated, and becomes more
complicated as the project using the library lives on for a decade or more.

You could use, for example:

(1) a URL
(2) several alternative URLs, all delivering the same content
(3) a crypto hash, with the content coming from some cache
(4) a copy of the raw data, with or without crypto signing

RnRS library names should be addresses in a project-local namespace that
is fully controlled by the project. It's good to have conventions, so
that the namespace of most Scheme projects looks familiar and is easy to
navigate. But importing DNS addresses into the library namespace is
giving people a comforting illusion.