3 ms·
I'll just leave this here: https://pypi.python.org/pypi/peep/ https://pypi.python.org/pypi/peep/. (It verifies Python package downloads against local hashes.)
by grincho 11y ago
I'll just leave this here: https://pypi.python.org/pypi/peep/ https://pypi.python.org/pypi/peep/. (It verifies Python package downloads against local hashes.)
- Nursie 11y agoThat certainly helps repeatability of install, but it doesn't (so far as I can tell) help if you've been MITM'd on first download. So it's a bit like a self-signed certificate at that point.