Post #1054132

@brettcannon Thanks for this writeup! "What can you do as a person if you don't have code to check that things line up (which isn't a lot of code; the lock file should have the index server for the package, so you follow the index server API to get the digital attestation for each file and compare)?" Let's build this into common tooling! Directly into installers like pip and uv? And pip/uv audit? #Python #security