Reproducible builds on PyPI: what's missing

What's missing to have reproducible builds on PyPI

Reproducible builds could let third parties verify that PyPI distributions match their source code, catching tampering like the SolarWinds attack. But current specs lack a way to record the source location and build tools for sdists and wheels. The author proposes recording this info in metadata, using SBOMs for wheels, and a new sdist format, with build backends automatically logging their environment. Trusted verifiers could then confirm reproducibility on PyPI, giving users confidence without extra work for producers.