Post #1834538

@ryanhiebert @brettcannon yeah, we need to figure out how we can provide some link to tie an archive on PyPI back to a claimed source code reference (whether that's git or a URL). Especially now that many folks are self-hosting their infrastructure. What comes to my mind is focusing on build reproducibility, submitting a "claim" within a package (source code ref, build backend version, tool versions, etc) and having that claim verified by another party.