sdist packages have 2 kinds of dependencies: build-time deps and runtime-deps. Before PEP-517, there was no standard to specify a package's build-time deps, but with PEP-517, a package defines its build-time deps in its pyproject.toml.
In an online install, pip reads it and downloads build-time deps and builds the sdist. In a vendored (offline) install, this is not possible because "pip download" is not smart enough to download build-time deps during vendoring (pypa/pip/issues/8302).
Before pip 23.1, when build-time deps were missing, pip fell back to using the legacy 'setup.py install' method. pip 23.1 removed this fallback and started enforcing PEP 517. Therefore, for vendored apps with sdists, we install the 2 most common build-time dependencies - wheel and setuptools. These are packaged by the dependency pipeline within the "pip" dependency.
sdist packages have 2 kinds of dependencies: build-time deps and runtime-deps. Before PEP-517, there was no standard to specify a package's build-time deps, but with PEP-517, a package defines its build-time deps in its pyproject.toml.
In an online install, pip reads it and downloads build-time deps and builds the sdist. In a vendored (offline) install, this is not possible because "pip download" is not smart enough to download build-time deps during vendoring (pypa/pip/issues/8302).
Before pip 23.1, when build-time deps were missing, pip fell back to using the legacy 'setup.py install' method. pip 23.1 removed this fallback and started enforcing PEP 517. Therefore, for vendored apps with sdists, we install the 2 most common build-time dependencies - wheel and setuptools. These are packaged by the dependency pipeline within the "pip" dependency.