For example, it maps Python packages to the pypi scheme, but it’s not necessarily true that we are providing the same thing that’s on PyPI.

We may apply patches or replace vendored dependencies. IIRC cryptography had a vulnerability in its statically-linked OpenSSL that would be fixed in nixpkgs in by updating or patching OpenSSL.

The other issue is with FOD-based fetchers. There’s no visibility into what Rust crates (fetchCargoVendor) or Node packages (fetchNodeDeps), which actually are (more or less) the unmodified packages.

I assume that would be actually be useful to have, but the problem being solved isn’t well-formulated. It’s just adding a thing someone’s company (presumably) wants.