cc @pablogsal

Hi @kumaraditya303. Thanks for your PR.

Unfortunately I cannot merge this PR directly as I need to
validate the contents of the binary files included, as this is a potential security concern.

Will try to check this as soon as possible if @ambv doesn't do it first :)

I am thinking about automating this step in cpython with a github action which runs every let's say a week or so and creates a PR with the latest pip and setuptools as manually it takes longer for pip to be updated in the repo and that will be more secure and fast rather than someone doing it.

Let me know your thoughts on this @pablogsal

uptools as manually it takes longer for pip to be updated in the repo and that will be more secure and fast rather than someone doing it.

That would be a lot of unnecessary churns. We only need to update these pre-release, so technically once a month is ok. On the other hand this can be something done in the release itself. Maybe @ambv has some ideas here

We can add a unit test that gets hashes of pip and setuptools from Warehouse’s JSON API (e.g., https://pypi.org/pypi/pip/21.3.1/json) and compares it to hashes of the vendored files.

Ah, that would certainly be interesting!

This PR is stale because it has been open for 30 days with no activity.

Thanks for the review but this is not ready to merge, there are now newer pip and setuptools versions (and possibly a new pip this week).

Plus see earlier discussion on how to do this in a way to better fit with the release and avoid churn.

Closing as this is outdated now.

Ah, that would certainly be interesting!

Done in #31885