[Catalog-sig] [Proposal] Registered packages must provide the source code distribution on PyPI

["Martin v. Löwis"]

>> Note that even a requirement to upload a package to PyPI won't reliably
>> solve Andreas' problem, the package owner could remove a release or even
>> the entire package.
>
> Released is released. There are only very few cases where one should be
> allowed to remove packages (e.g. containing viruses, malware etc.).
> Otherwise released stuff must not be touched.

Not at all. If a package owner decides to delete a package, the package 
is completely erased from PyPI. This is how it is, and how it should be.
PyPI has no right to keep the file against the author's will.

Regards,
Martin