make it impossible to re-register a deleted package

[monperrus]

The possibility to register a deleted package is bad for software supply chain security, see

Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk
https://jfrog.com/blog/revival-hijack-pypi-hijack-technique-exploited-22k-packages-at-risk/

The post mentions some previous conversation with Pypi maintainers (public? private?), this issue makes this important problem visible in the issue tracker.

Stop Allowing deleting things from PyPI?, is related but slightly different.

[miketheman]

Hi there! You've linked to the Discuss thread, and there's a fresh one over here: https://discuss.python.org/t/pre-pep-limiting-deletions-on-pypi/66351
Closing this issue in favor of the conversation, and once resolved, we can entertain action here.

[monperrus]

thanks for the link @miketheman