You're absolutely right. It's the reason we always use devpi for python mirrors, and firewall off CI. Ultimately you need to be able to rebuild the product whe

You're absolutely right. It's the reason we always use devpi for python mirrors, and firewall off CI. Ultimately you need to be able to rebuild the product when upstream goes poof.