Thoradia Quack

I did my best to fit the bill: source package are pinned, hash-checked and stored in $SOURCES/pip I think that some packages (pycparser, setuptools, setuptools_scm, wheel) can be removed from...

@HiassofT @CvH The packages could be downloaded by scripts/get using the URLs below. Is there a way to scripts/get more than one file in a single package.mk? ``` https://files.pythonhosted.org/packages/05/54/3324b0c46340c31b909fcec598696aaec7ddc8c18a63f2db352562d3354c/cffi-1.14.0.tar.gz https://files.pythonhosted.org/packages/ae/e7/d9c3a176ca4b02024debf82342dab36efadfc5776f9c8db077e8f6e71821/pycparser-2.20-py2.py3-none-any.whl...

This is the best I can do without further help unpack() only downloads the missing sources to $SOURCES/tuf Sources are pinned and hash/version-checked at build time