From fea0a8cce2ebd9facc73dc5d90fa2e587c2adacd Mon Sep 17 00:00:00 2001
From: Charles Harris <charlesr.harris@gmail.com>
Date: Sat, 24 Oct 2026 21:16:48 -0600
Subject: [PATCH] MAINT: Use safe pip

Pip needs to updated to a secure version on account of the eMudhra
compromise. This does this by creating a script to install the
safe version, and then running the script where needed. Two files
are affected:

- tools/wheels/bootstrap-pip.sh # install secure pip
- github/workflows/wheels.yml # runs the script where needed

Pair programmed with Grok.
---
 .github/workflows/wheels.yml  | 7 +++++++
 tools/wheels/bootstrap-pip.sh | 8 ++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 tools/wheels/bootstrap-pip.sh

diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index 7d3c021..3539607 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -196,8 +196,15 @@ jobs:
           ref: ${{ env.SOURCE_REF_TO_BUILD }}
           persist-credentials: false
 
+      - name: Checkout numpy-release
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: numpy-release
+          persist-credentials: false
+
       - name: Build sdist
         run: |
+          bash numpy-release/tools/wheels/bootstrap-pip.sh
           python -m pip install -U pip build
           python -m build --sdist -Csetup-args=-Dallow-noblas=true
 
diff --git a/tools/wheels/bootstrap-pip.sh b/tools/wheels/bootstrap-pip.sh
new file mode 100644
index 0000000..d255b39
--- /dev/null
+++ b/tools/wheels/bootstrap-pip.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Secure bootstrap for pip >= 26.2.2 (eMudhra/emSign CA incident)
+set -euo pipefail
+WHEEL="https://files.pythonhosted.org/packages/3f/06/\
+3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/\
+pip-26.2.2-py3-none-any.whl"
+SHA="fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+python -m pip install "pip @ ${WHEEL}#sha256=${SHA}"