Supply chain TODO:
- switch from http://setup.py to lockfile for your app
- switch to `pip install --binary-only=:all:`
- scan your deps before you install them (only ochrona does this)
- vendorize abandonware, if I wanted to maliciously attack something, I'd start there
- switch from http://setup.py to pyproject.toml for libraries, always build a wheel
- don't use code w/o explicit license, it is a proxy for "is an irresponsible clown publishing this library"
- run a quality check on the lib before taking a dependency (eg snyk's site)♡ 0 ↻ 0