I know it is unsafe to install software (including Python packages) from not trusted or compromised sources.
However I wonder how safe I am when I am installing a trusted package from Python Package Index or from Anaconda repository (which I also consider trusted).
Packages in PyPI may be PGP signed, which makes me believe it is fair safe to install/update them manually.
I wonder how sure can I be there is no MITM attack when I connect to PyPI (or Anaconda) repositories with either
pip connection uses at least SSL with certificate verification (it is known to fail with SSL error), but given that pip used plain HTTP as default in 2013 I am pretty sceptical about how strict it is e.g. in case of trusted root CA (for example if it trusts StartCOM and WoSign or not).
Does anyone know what level of security do I have when I decide to use Python package managers?
My question is about safety of PyPI (and similar) clients and their connection to server while Which security measures does PyPI and similar third-party software repositories take? is about whether packages at PyPI may be trusted. In my question PyPI and packages at the server site are assumed to be trusted.