> Some very similar ideas were discussed in 2018 here. The link points to a page[0] of discussions from "February 18, 2021". I don't know if that's a date par

> Some very similar ideas were discussed in 2018 here. The link points to a page[0] of discussions from "February 18, 2021". I don't know if that's a date parsing bug, but the question of whether packages match their upstream source actually was considered in 2018 for the NPM ecosystem[1] which led to the creation of a tool called TBV (Trust But Verify). Unfortunately the idea didn't seem to get much traction beyond that. [0] https://internals.rust-lang.org/t/making-crates-io-verify-code-against-repository/14075 https://internals.rust-lang.org/t/making-crates-io-verify-co... [1] https://hackernoon.com/what-if-we-could-verify-npm-packages-c2a319cff758 https://hackernoon.com/what-if-we-could-verify-npm-packages-...