Thanks @ichard26 , I believe I've addressed all your issues. Thanks for catching the dead code, I'd tried a few different approaches and apparently hadn't done a thorough enough clean up.

I won't have time to review this before the release. Do you still want it in 26.1? How risky is it?

Do you still want it in 26.1?

Yes.

How risky is it?

Touching the self update check code has historically reared unexpected issue. I've done my absolute best to validate all the issues we've seen in the past (different upgrade/downgrade paths).

Frankly though, if this PR is considered too risky I think we should disable the self update check, at least for 26.1, it's a one-line change.

How risky is it?

Given the core logic is wrapped defensively in a try except, I think it'll be fine...?

I tested how it'd handle non-standard indices and an no/bad internet connection and it seemed fine.

Also, the last issue we had with the self check involved pip replacing itself. Given we're now blocking it from running whenever a pip requirement is given eliminates that class of issues.

I did an extra pass on validating this doesn't create any new errors, I did find some existing bugs which I will put on my to do list as a follow up, but nothing new.

1. Add an env argument way to skip the pip update check?
   • Should there be - or is there already - an env argument way to skip this update check?
     • yes; there should be a way
       • use cases
         • closed-loop, self-hosted
         • third-party index servers only
         • python -m ensurepip

           Note: This module does not access the internet. All of the components needed to bootstrap pip are included as internal parts of the package.
           https://docs.python.org/3/library/ensurepip.html

2. Update the ensurepip copy of pip
   • python -m ensurepip -U/--upgrade
   • "Update strategy for pip in ensurepip (for security maintenance releases) - Core Development" (2024) https://discuss.python.org/t/update-strategy-for-pip-in-ensurepip-for-security-maintenance-releases/50316
   • https://sourceforge.net/p/upgrade-ensurepip/code/ci/default/tree/upgrade_ensurepip.py (2020)
   • the tool or the maintainer must check the checksum and the
   • there is an Integrity API to check instead of checking GPG signatures and (pip) release signing keys? https://blog.pypi.org/posts/2024-11-14-pypi-now-supports-digital-attestations/
   • does pip download pip verify the Integrity API signature of pip sufficiently for repacking pip as the ensurepip module in stdlib?

Do you have a specific issue? If so please open a new issue.

PIP_DISABLE_PIP_VERSION_CHECK=1 should work to disable pips version check.

Does the copy of pip that ships with Python need to be updated too?

Yes, but that will be occur at a future date. #13795 will contain the most up to date details.