I got this report through our security reports from an anonymous individual:

Running a static code analyser over a codebase including setuptools has identified that urlopen is used without passing an SSL config here https://github.com/pypa/setuptools/blob/main/setuptools/config/_validate_pyproject/formats.py#L118 – which means that the SSL certificate isn’t verified.

This isn’t an area I’m an expert in, but documentation suggests that we should be passing e.g. context=ssl.create_default_context() - see https://docs.python.org/3.5/library/urllib.request.html and https://docs.python.org/3.5/library/ssl.html#ssl.create_default_context

I agree there may be a security concern, but I deem it low impact (worst case, a malicious actor could inject invalid classifiers or remove valid ones, merely causing disruption to a build in a local context), so safe to disclose.