3 ms·
wasnt PEP 740 an attempt to solve this?
by functional_dev 6mo ago
wasnt PEP 740 an attempt to solve this?
- woodruffw 6mo agoDepends on what you mean by “this.” If you mean build provenance, yes, if you mean transmuting PyPI into the kind of trust topology that Debian (for example) has, no. (I think PEP 740 largely succeeds at providing build provenance; having downstream tooling actually do useful things with that provenance is harder for mostly engineering coordination reasons.)