Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bpo-46119: Update bundled pip to 21.3.1 and setuptools to 59.7.0 #30178

Closed
wants to merge 2 commits into from

Conversation

kumaraditya303
Copy link
Contributor

@kumaraditya303 kumaraditya303 commented Dec 18, 2021

@kumaraditya303
Copy link
Contributor Author

cc @pablogsal

@pablogsal
Copy link
Member

Hi @kumaraditya303. Thanks for your PR.

Unfortunately I cannot merge this PR directly as I need to
validate the contents of the binary files included, as this is a potential security concern.

Will try to check this as soon as possible if @ambv doesn't do it first :)

@kumaraditya303
Copy link
Contributor Author

I am thinking about automating this step in cpython with a github action which runs every let's say a week or so and creates a PR with the latest pip and setuptools as manually it takes longer for pip to be updated in the repo and that will be more secure and fast rather than someone doing it.

Let me know your thoughts on this @pablogsal

@pablogsal
Copy link
Member

uptools as manually it takes longer for pip to be updated in the repo and that will be more secure and fast rather than someone doing it.

That would be a lot of unnecessary churns. We only need to update these pre-release, so technically once a month is ok. On the other hand this can be something done in the release itself. Maybe @ambv has some ideas here

@illia-v
Copy link
Contributor

illia-v commented Dec 21, 2021

We can add a unit test that gets hashes of pip and setuptools from Warehouse’s JSON API (e.g., https://pypi.org/pypi/pip/21.3.1/json) and compares it to hashes of the vendored files.

@pablogsal
Copy link
Member

Ah, that would certainly be interesting!

@github-actions
Copy link

This PR is stale because it has been open for 30 days with no activity.

@github-actions github-actions bot added the stale Stale PR or inactive for long period of time. label Jan 22, 2022
Copy link
Contributor

@MaxwellDupre MaxwellDupre left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks straight forward.

@hugovk
Copy link
Member

hugovk commented Feb 7, 2022

Thanks for the review but this is not ready to merge, there are now newer pip and setuptools versions (and possibly a new pip this week).

Plus see earlier discussion on how to do this in a way to better fit with the release and avoid churn.

@kumaraditya303
Copy link
Contributor Author

Closing as this is outdated now.

@illia-v
Copy link
Contributor

illia-v commented Mar 14, 2022

Ah, that would certainly be interesting!

Done in #31885

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
awaiting core review stale Stale PR or inactive for long period of time.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants