Currently get-pip.py is downloaded from a remote server and installed without checking that it's legitimate [1]
I'm aware that there's no official way to verify the downloaded file and also that it might change at any time, so IMHO it might be good to keep a local, known to be good, version of that file and update it from time to time.
[1]
|
wget -O get-pip.py 'https://bootstrap.pypa.io/get-pip.py'; \ |
Currently
get-pip.pyis downloaded from a remote server and installed without checking that it's legitimate [1]I'm aware that there's no official way to verify the downloaded file and also that it might change at any time, so IMHO it might be good to keep a local, known to be good, version of that file and update it from time to time.
[1]
python/3.7/stretch/Dockerfile
Line 110 in 13ae0c0