The more I think about supply chain risks, the more I think you should vendorize your entire dependency graph. Each time you run `pip install` you're either laboriously establishing trust or unprofessionally throwing caution to the wind.
Post
December 4, 2021