[Catalog-sig] an immutable mirror of PyPI

[P.J. Eby]

At 09:55 AM 7/20/2011 +0100, Chris Withers wrote:
>On 20/07/2011 09:54, M.-A. Lemburg wrote:
>>You mean: an extension that allow pinning versions
>
>buildout allows version pinning out of the box.
>
>>just one that checks the downloads against the hashes provided by
>>the index server  (if it does) ?
>
>yes, I think, but I'm not 100%

Buildout uses setuptools, and setuptools checks the hashes provided 
by the index server.  So, by default, buildout is probably checking them.