pypa / get-pip

Helper scripts to install pip, in a Python installation that doesn't have it.
https://bootstrap.pypa.io/pip/
MIT License
738 stars 293 forks source link

Validating the authenticity of get-pip.py #206

Closed mcpate closed 6 months ago

mcpate commented 6 months ago

Hey team/community! Is there a recommended way to validate the integrity of get-pip.py? I've downloaded and am planning on using https://bootstrap.pypa.io/pip/2.7/get-pip.py, and I'd love to validate the authenticity of the file I've downloaded, but I don't see any way to do so (signing keys, SHAs, etc.). Any suggestions you can provide would be greatly appreciated.

pradyunsg commented 6 months ago

Duplicate of #41 and #47