Repository navigation
Upgrade certifi to 2026.10.19 (drops emSign ECC Root CA - G3) - #228
Merged
Merged
Conversation
eMudhra's emSign ECC Root CA - G3 private key is reported compromised. Debian's security team removed the root from ca-certificates on 2026-10-20 (20250419+deb13u1, Debian bug #1151413), and certifi 2026.10.19 removes it from its bundle. requests and httpx verify against certifi, not the system store, so the Debian update alone does not protect the server's outbound HTTPS (news scraping, the TTS and LLM APIs) until this lock is deployed. 2026.10.19 rather than 2026.10.18: .18 dropped all four eMudhra roots, and .19 restored the three that are not affected (emSign Root CA - G1, C1 and ECC C3), as Debian also did. Apart from G3, the 2026.10.19 bundle is identical to 2026.7.22, and the package code changed only in its version string. The lock keeps revision = 3. uv 0.13 rewrites it as revision 5 on any relock. That was reverted by hand because the uv on frida that runs `uv sync --frozen` in deploy.sh may be older and has not been checked. `uv lock --locked` accepts the result as current. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
eMudhra's emSign ECC Root CA - G3 key is reported compromised. Debian's security team removed the root from
ca-certificateson 2026-10-20 (20250419+deb13u1, Debian bug #1151413). Python HTTP clients verify against certifi rather than the system store, so this lock bump is needed too.__version__; the remaining emSign roots have the same fingerprints as Debian's.revision = 3kept inuv.lock(uv 0.13 writes 5) because frida's uv version is unchecked. Takes effect on frida only afterscripts/deploy.sh.🤖 Generated with Claude Code