Upgrade ensurepip bundle to point to pip>=26.1 to address CVE-2026-6357

Author: derrickaw

sdks/python/container/Dockerfile

@@ -85,14 +85,20 @@ RUN  \
     rm -rf /root/.cache/pip && \
 
     # Update ensurepip to use most recent versions of setuptools and pip. This avoids some vulnerabilities which won't be fixed on older versions of python.
-    pip install upgrade_ensurepip && \
-    python3 -m upgrade_ensurepip && \
-    # setuptools is not bundled with ensurepip in Python 3.12+
+    # Note: We do not use the third-party 'upgrade_ensurepip' package because:
+    #   1) It is incompatible with Python 3.12+ (which no longer bundles setuptools inside ensurepip, causing an AssertionError).
+    #   2) It queries public PyPI via raw HTTP calls, failing in sandboxed build environments with custom package mirrors.
+    # Instead, we download the wheels via pip and patch ensurepip's version mapping manually.
+    pip download --dest /usr/local/lib/python${py_version}/ensurepip/_bundled/ --only-binary=:all: "pip>=26.1" && \
+    python3 -c 'import ensurepip, glob, re; whl = glob.glob(ensurepip.__path__[0] + "/_bundled/pip-*.whl")[-1]; version = re.search(r"pip-(.*?)-py", whl).group(1); init_py = ensurepip.__file__; content = open(init_py).read(); content = re.sub(r"_PIP_VERSION = \".*?\"", f"_PIP_VERSION = \"{version}\"", content); open(init_py, "w").write(content);' && \
+    if [ "${py_version}" = "3.10" ] || [ "${py_version}" = "3.11" ]; then \
+        pip download --dest /usr/local/lib/python${py_version}/ensurepip/_bundled/ --only-binary=:all: "setuptools" && \
+        python3 -c 'import ensurepip, glob, re; whl = glob.glob(ensurepip.__path__[0] + "/_bundled/setuptools-*.whl")[-1]; version = re.search(r"setuptools-(.*?)-py", whl).group(1); init_py = ensurepip.__file__; content = open(init_py).read(); content = re.sub(r"_SETUPTOOLS_VERSION = \".*?\"", f"_SETUPTOOLS_VERSION = \"{version}\"", content); open(init_py, "w").write(content);'; \
+    fi && \
     if [ "${py_version}" = "3.10" ] || [ "${py_version}" = "3.11" ]; then \
         find /usr/local/lib/python${py_version}/ensurepip/_bundled/setuptools-* -type f ! -name $(basename $(ls -v /usr/local/lib/python${py_version}/ensurepip/_bundled/setuptools-*-py3-none-any.whl | tail -n 1)) -delete; \
     fi && \
     find /usr/local/lib/python${py_version}/ensurepip/_bundled/pip-* -type f ! -name $(basename $(ls -v /usr/local/lib/python${py_version}/ensurepip/_bundled/pip-*-py3-none-any.whl | tail -n 1)) -delete && \
-    pip uninstall upgrade_ensurepip -y && \
     python3 -m ensurepip && \
     python3 -c "import ensurepip; assert list(map(int, ensurepip._PIP_VERSION.split('.'))) >= [26, 1], f'Bundled pip version {ensurepip._PIP_VERSION} is older than 26.1';"