Hacker News new | ask | show | jobs
by shanipribadi 1265 days ago
hashes would also need to be specified for all dependencies (transitives) in case they were needed,

and all dependencies need to be pinned to specific versions as well. hence this would only work when users are making use of venvs, instead of user install / site install setup.