[Catalog-sig] Proposal: close the PyPI file-replacement loophole

[Antoine Pitrou]

Michael Foord <fuzzyman <at> gmail.com> writes:
> 
> Given the issues with md5, adding SHA (or similar) hashes to pypi would
> be a much better use of time (IMO).

Also, implement http://www.python.org/dev/peps/pep-0381/#mirror-authenticity

Regards

Antoine.