[teacpde]

So the mirror will serve both the package and signed hashes, what if the package has been indexed in the central index but not yet signed by the notary?

[emersion]

Maybe asking a hash to the notary will actually make the notary fetch and hash the package if it doesn't know about it yet?

(Related: https://news.ycombinator.com/item?id=18717766)

[teacpde]

That works, but slows down the mirror? I guess it is okay since it should only happen once.