Since they have "A Note about Security", how about locking down that Python environment? - Add hashes to their already-pinned requirements.txt deps: https://pi

Since they have "A Note about Security", how about locking down that Python environment? - Add hashes to their already-pinned requirements.txt deps: https://pip.pypa.io/en/stable/reference/pip_install/#hash-checking-mode https://pip.pypa.io/en/stable/reference/pip_install/#hash-ch... - Add a Makefile entry to run `[ -d your-environment ] || ( virtualenv your-environment && . your-environment/bin/activate && ./your-environment/bin/pip install --no-deps --require-hashes -r requirements.txt )`