[Catalog-sig] [Proposal] Registered packages must provide the source code distribution on PyPI

["Martin v. Löwis"]

> What us buildout users really want is for the simple index to contain a copy
> of the uploaded files (or at least the source packages). Instead of creating
> links to other referenced urls in the simple index, setuptools / distribute
> could be used to fetch the package and store  a copy. A flag could be set on
> indexed proprietary packages to exclude them from the simple index.
>
> There would seem to be a great benefit to doing this centrally and mirroring
> out the result rather than multiple companies maintaining their own
> individual pypi mirrors.

I can understand the need, but I would propose an entirely different 
solution:

Have buildout, by default, reject downloads from a different server. 
Then, when you create the dependency, you already notice the problem, 
and may chose to drop the dependency.

I don't think any policy change will force users to upload if they 
really don't want to. Instead, the major effect of the policy 
(apparently) would be that they stop registering with PyPI.

Regards,
Martin