title: pip download without executing setup.py
body: <p>How to download a distribution, possibly sdist, without potentially executing a <code>setup.py</code> file (that may contain malicious code)?</p>
  
  <p>I don't want to recursively get the dependencies, only download one file for the specified distribution. Attempt that doesn't work:</p>
  
  <pre><code>pip download --no-deps mydist
  </code></pre>
  
  <p>Here is a reproducible example that demonstrates the <code>setup.py</code> is still executed in the above case:</p>
  
  <pre class="lang-sh prettyprint-override"><code>$ docker run --rm -it python:3.8-alpine sh
  / # pip --version
  pip 20.0.2 from /usr/local/lib/python3.8/site-packages/pip (python 3.8)
  / # pip download --no-deps suds
  Collecting suds
    Downloading suds-0.4.tar.gz (104 kB)
       |████████████████████████████████| 104 kB 13.4 MB/s 
      ERROR: Command errored out with exit status 1:
       command: /usr/local/bin/python -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-download-yqfdz35d/suds/setup.py'"'"'; __file__='"'"'/tmp/pip-download-yqfdz35d/suds/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(__file__);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, __file__, '"'"'exec'"'"'))' egg_info --egg-base /tmp/pip-download-yqfdz35d/suds/pip-egg-info
           cwd: /tmp/pip-download-yqfdz35d/suds/
      Complete output (7 lines):
      Traceback (most recent call last):
        File "&lt;string&gt;", line 1, in &lt;module&gt;
        File "/tmp/pip-download-yqfdz35d/suds/setup.py", line 20, in &lt;module&gt;
          import suds
        File "/tmp/pip-download-yqfdz35d/suds/suds/__init__.py", line 154, in &lt;module&gt;
          import client
      ModuleNotFoundError: No module named 'client'
      ----------------------------------------
  ERROR: Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.
  </code></pre>
  
  <p>I cannot use <code>--no-binary</code> option, because I don't want to exclude source distributions.  I just want to avoid executing their source code.</p>