[tianon]

Upstream is not updating the pip bundled with 3.11 and 3.12, and its vendored "certifi" bundle still trusts a compromised CA. Apply Debian's "certifi-debian-ca-certificates" patch (downloaded via a raw URL pinned to a Debian commit and verified by checksum, with the Debian branding adjusted on Alpine) to both the installed pip and the bundled "ensurepip" wheel so new venvs are covered too. Keyed on the exact versions so any upstream update drops it automatically.

Refs:

• These images ship vulnerable pip #1142

[yosifkit]

As seen in the discussion (https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576/19), these old pip versions are subject to other vulnerabilities and it is recommended to use the latest pip. We recommend that you upgrade to the latest (like pip install --upgrade pip) and this patch will allow you to now do that in the 3.11 and 3.12 Debian and Alpine images without worrying about the compromised CA certs. If you can't use a newer pip because of backwards incompatibilities, you should definitely look at any other possible vulnerabilities in those pip versions and see how you can protect your builds.

[edmorley]

I think python/cpython#160040 if backported to 3.11 and 3.12, will protect older pip against the older certifi bundled within it, making this PR no longer needed?