Remix.run Logo
crabbone an hour ago

These people are so far gone in their fantasy land...

> So we either have to shrug and say, "don't use sdists if you want reproducible builds,"

What is this, I can't even... How can anyone expect to have a reproducible build's artifact if they downloaded the source?

Now, and most importantly, all this talk is about "pure" (as in Python-only) packages. This is, practically, worthless for most real Python projects because those rely on native bindings. Why should anyone expect PyPI to be able to build those if no standard procedure exists for building them is beyond comprehension.