On a topic somewhat related to #1238, would you consider distributing wheels for winpython, the Python package, as release products? I understand that you decided against uploading to pypi due to concerns that the patching of pip and other packages might not pass whatever security rules they have. However, the current process of having to bootstrap a Python environment to build the wheel, in order to kick start the real build process, is a bit complicated.

You could consider getting Github Actions to build the wheel for you as CI, and then use that to start the distribution building process?

EDIT: By the way, Readme currently says that the winpython package can be downloaded from pypi to upgrade an existing install. However, wheels on pypi haven't been updated for 10 years, so that might be confusing, even if the main patch for pip may not have changed much. If you agree to releasing wheels, maybe that can be changed to refer to wheels here. If you don't want to release wheel, you might want to delete or rephrase that statement from Readme.

EDIT 2: Readme also refers to setup.py, but I understand that no longer exists as a result of switching to Flit.