Hi. I'd like to have a couple of suggestions for ReactOS Update and package management to discuss about.
1. Update Management
The 2 concepts you have all their advantages and disadvantages. I'd like to add one more possibility: First, TUP, The Update Framework. The specification is here. If there is no work started in this manner, starting from scratch with this one would be helpful. As the specification is mature enough and reached v1.0, it's the specification that matters. Although it is the longest track to run, at least the path to run is specified. It is both APACHE and MIT licensed, so it can be called GPL-compatible.
The thing is there are two requirements about integration that might cause issues. One is Windows File Protection, which is not implemented yet. The other one is SCCM related, OSD. The task sequences. Therefore, whatever the framework behind, it might need to be integrated to SCCM in the future. So, I believe, it can be built to be compatible with SCCM from scratch.
2. Package Management
Windows systems have an alternative package management system used in enterprises for years. The one used in SCCM has a central repo and already have their tooling, commercial and open source ones. Therefore creating, distributing and installing software packages can be unified using already used architectures. I believe this is better than working on an architecture from start.