What's missing to have reproducible builds on PyPI
Summary
The article argues that reproducible builds are essential for a secure Python packaging supply chain, explains gaps between sdists and wheels, and discusses how SBOMs and build backend provenance could enable reproducible builds on PyPI; it also proposes trusted verifiers and display mechanisms to surface reproducibility.