You are correct. Start distributing and requiring hashes with your Python dependencies instead. This thing is a non-solution to a non-problem. (The adversaries

You are correct. Start distributing and requiring hashes with your Python dependencies instead. This thing is a non-solution to a non-problem. (The adversaries won't be MiTM'ing Github or Pypi.) The actual problem is developers installing "foopackage" by referencing the latest version instead of vetting their software supply chain. Fixing this implies a culture change where people stop using version numbers for software at all.