Fellow members of the shadowy Cabal, I've been looking at making the mirror client supply the original uploading user/upload time when it mirrors a package. I've developed an approach (attached) that, rather than PUTting a simple tarball to mirror, PUTs a combination of the tarball, user name and upload date in multipart/form-data format. This works (though the code is a bit grungy still). The only thing I'm worrying about before I tidy it up and commit is whether it is sufficiently RESTful: it feels a bit weird that the thing that you PUT is not what you get back from making a GET request to that URL. An alternative approach would be to expose resources for the uploader/upload time of a package, which the mirror client could then simply PUT to. Anyone have any thoughts on the right approach here? Max