this would be safer and more reliable as you’re not pulling (potentially tampered w/) sources from pypi