pypa/pip — pull request #402 by carljm (2011-12-12 22:05:02+00:00)
Title: Extended PEP 381 mirror and package verification features.

This includes the following modifications:

- The PyPI mirrors are now used by default. You can disable them
by specifying `--no-mirrors`. Each mirror is now tried one by
when when retrieving a distribution instead of naively randomizing
the list of index URLs. Distributions from mirrors whose signature
don't match are ignored.

- Added `--refresh-serverkey` option to `install` command to retrieve
the public PyPI server key used to verify the mirror packages,
caching it as ~/.pip/serverkey.pub. Same thing happens (once) it
doesn't exist.

- Added ability to verify the SSL certificate of PyPI. This requires
the ssl module added in Python 2.6. For Python < 2.6 the standalone
version at http://pypi.python.org/pypi/ssl can be installed instead.
Using https://pypi.python.org/ is the default now.

- Added OrderedDict for Python < 3.1 used in PackageFinder when
collecting packages links for easier handling.

- A bunch of PEP 8 related fixes.