*edit The linked article and the resulting discussion will have almost no value. The post is old, and doesn't make a coherent argument other than one of inacti

*edit The linked article and the resulting discussion will have almost no value. The post is old, and doesn't make a coherent argument other than one of inaction. It would be best to leave it alone and let it drop off the main page. ---- Do nothing, because it won't cover all the corner cases. No one said it was the Holy Grail (or the Holy Hand Grenade). You want UNSIGNED packages? This post is a distraction. > This system does have one major advantage in that you have mirror validation built in. Since the validation is based on the package, not on the mirror you downloaded from, as long as the signature is valid you know it came from the trusted build machine. PyPI should have already worked this way when the post was made. The mess that is PyPI shouldn't be used as evidence for anything other than PyPI is a mess.