requirements.txt
foo="*" <-- get the latest! someone highjacked the acct & published malicious code? get that too!
foo="2.1" <--- still not pinned securely
markdown==3.1 \
--hash=sha256:fc4 <-- If it was secure then, it is secure now. Don't know if it was sure back then!
The missing puzzle piece is gpg signatures, which pypi is trying to remove instead of improving. I don't understand why. I guess defensively, you would put all packages in your own private repo & resign everything? All options forward look difficult.
♡ 2 ↻ 0