The Python ecosystem is pushing towards using https://pypi.org/project/truststore/ rather than solutions like certifi. This incident will likely help increase the priority of that transition.
On Fri, 2026-10-23 at 00:07 +0300, Valtteri Vuorikoski wrote: > Having spent the day whacking this particular molehill, my strong opinion is > that these packages (minus certifi) should stop vendoring roots immediately. > > Users should install their distro's ca-certificates package or similar. If > that > is completely impossible for whatever reason, offer an option to use certifi > (which should be a dependency, not vendored) - but the system trust store > should > be the default source of truth. > > This sort of easter egg hiding to serve users with broken installations > reduces > the security of everyone else. > > (Missing from the quoted list: botocore also includes a vendored copy. I > haven't > checked how it's used.) > > -valtteri > > > On Thu, Oct 22, 2026 at 01:43:08PM -0700, Alan Coopersmith wrote: > > https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 > > has this statement from Seth Michael Larson: > > > A security incident affecting eMudhra intermediate certificates has > > > required removing the emSign root CA certificate from CA bundles such > > > as “certifi”. It’s important to immediately upgrade the software > > > packages below to at least the versions specified and rebuild > > > container images with layer caching disabled to fetch the latest > > > system certificates. Failure to do so could result in > > > monster-in-the-middle (MITM) attacks against TLS clients, including > > > python.org and pypi.org . > > > > > > certifi 2026.10.19 (1) > > > pip 26.2.2 > > > uv 0.13.4 > > > sigstore 4.5.1 > > > conda 26.9.4 > > > pixi 0.82.1
signature.asc
Description: This is a digitally signed message part
