Repository navigation
Relock certifi and ca-certificates for the eMudhra CA revocation - #305
Merged
Merged
Conversation
Eight eMudhra/emSign intermediate CAs were issued with recoverable private keys and have been revoked as compromised. Any environment still carrying the previous bundle trusts certificates an attacker can mint at will, so the bundle has to move in every locked environment, not just in the OS store. Lock certifi and ca-certificates at 2026.10.19, the first release to drop the affected roots. This workspace declares no dependency cooldown, so the lock alone carries the change.
|
coverage: 87.862%. remained the same — fb-certifi-lock-update into master |
nicoddemus
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Relocks
certifiandca-certificatesat2026.10.19, the bundle that drops the eMudhra/emSign intermediate CAs revoked as compromised on 2026-10-18. Updating the OS trust store is not enough — pixi environments carry their own copies.Lock-only: this workspace declares no dependency cooldown, so
pixi.tomlneeds no change. The lock diff touches no package other than those two.See ESSS/eden#900 for the full background on the incident and how the new bundle was verified.
🤖 Generated with Claude Code