Install script version pinning?

[jonapich]

Can we get a documented way of pinning the install script? The suggested method of using curl on a URL that can point anywhere is not suitable for security and consistency reasons.

Our current workarounds:

1. Keep a copy of the script in the repo
2. Curl https://github.com/python-poetry/install.python-poetry.org instead, using a sha

[neersighted]

From https://python-poetry.org/docs/#ci-recommendations:

Downloading a copy of the installer script to a place accessible by your CI pipelines (or maintaining a copy of the repository) is strongly suggested, to ensure your pipeline’s stability and to maintain control over what code is executed.

If you're interested in making what this script installs pinned, that would be #57 which is blocked by python-poetry/poetry-plugin-export#118.