Badly. Best I can tell, you can't even get the source for a certain build. Even if the owners bother to put a tag in git, there's no proof that's the code they

Badly. Best I can tell, you can't even get the source for a certain build. Even if the owners bother to put a tag in git, there's no proof that's the code they used or even necessarily how they built it. Everything on PyPI is just random artifacts uploaded by whoever ran a build script on their machine - it's nuts.