maintainer-feedback requested: [Bug 299701] devel/py-pip: compromised certificates due to eMudhra incident
Date: Thu, 22 Oct 2026 11:40:44 UTC
Bugzilla Automation <bugzilla@FreeBSD.org> has asked freebsd-python (Nobody) <python@FreeBSD.org> for maintainer-feedback: Bug 299701: devel/py-pip: compromised certificates due to eMudhra incident https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299701 --- Description --- pip bundles its own CA certificates, which it uses in addition to the system certificates. These need to be updated to provent MITM attacks due to the recent eMudhra incident. See discussion: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-ems ign-ca-certificate-security-incident/109576 The best option might be to do what Debian does and patch pip to only use the system certificates: https://salsa.debian.org/python-team/packages/python-pip/-/blob/master/debian/p atches/certifi-debian-ca-certificates.patch?ref_type=heads Otherwise pip needs to be updated to a version that includes an updated certificate bundle.