My point is adding stuff to an existing version doesn’t make it immutable like it should
replyI'm learning here, but for option 2, besides the security risk, doesn't this create the possibility that users could get a broken/unfinished package any time they're updating to a recently "published" release? The property of releases being atomic seems very important.
replyGenerally each artifact in the release is atomic, as is (and was) the case here.
replyYou’ll never get served a partially uploaded wheel for amd64 Linux, but somebody could come back a year later and add a 2nd wheel to that release for a different architecture.