pmgen.py is downloaded without checking the cryptographic hash

[yurivict]

here

Authenticity of all downloaded files should be verified using cryptographic hash fingerprints.

Nowadays there are whole countries that require country-wide SSL certificate to be installed, for example Kazakhstan. This allows them to seamlessly substitute any downloaded file. The client has the responsibility to check all downloads.

Kazakhstan can easily hack users' computers by substituting the file like pmgen.py.

In this particular case, why don't you just save this file into the repository? Why download it?