@simon @djh Thanks for the tag Simon, indeed when a publisher is specifically in the "pending" state I believe there isn't any pinning to a specific "ID" until after first "use".

I wonder if it could be improved a bit by doing an initial request to GitHub's API and bind to the ID early? Might be worth opening an issue :)

@simon @djh After that first use though PyPI stores more information about the repository and owner beyond the name that would mean renaming can't be abused this way.

@simon @sethmlarson Gotcha thanks for the details! Sounds good, I was just wondering how these simple systems on their own interact in complex ways when plugged into each other.