Please provide a digital signature

[szepeviktor]

See the real danger in https://twitter.com/pear/status/1086634389465956352
and pypa/get-pip#41

Related #171

[szepeviktor]

You could consider placing the bash script and the signature on very different platforms.

[szepeviktor]

@drazisil Thank you for providing the hash.

Could you make it available for a script (a machine) too?

[drazisil]

@szepeviktor Could you describe more what you are looking for? Do you mean as a separate, fetchable file?

[szepeviktor]

@drazisil Yes. Please see the links at the top. I would be ideal to host the bash script on one infrastructure and the hash on another one.

So one can verify the hash in a script.