Another pypi issue I've been wondering about recently is binary wheels. We saw an issue a few weeks back where pipenv hashes stopped matching because binary whe

Another pypi issue I've been wondering about recently is binary wheels. We saw an issue a few weeks back where pipenv hashes stopped matching because binary wheels were added for a package years after the last release, and it wasn't immediately obvious how to check if they were legitimate. It would be nice if there was some automated scan to check that binary builds match the source. I think there have been some python package reproducible build efforts at Debian, and there's a standard image for building wheels, so maybe that's somewhat possible?