From nobody Thu Oct 22 11:40:44 2026 X-Original-To: python@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9PNX6D4vz6wq5X for ; Thu, 22 Oct 2026 11:40:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9PNX4hgdz4Rpw for ; Thu, 22 Oct 2026 11:40:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792669244; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FFAB8afEAHqDGd6biv4DYJdLi/Fjq/lYGsT21l41ioE=; b=l5C2HR07VG8ibD2egZyNAVnZX652kd0azNDb7psCGYQ3ypqcXpITkI1uVM5/g/facoWX7t 3fIH+KDbRL4M/Eo/n//C9hA8SVr3Y5Qyp2j1Qd/V/i0P5Wj5yUPhBaHbfsu//yfJDBmsw4 IgxbRPywsm5o/7FUIAYPpP6w2WLviROsRWy26eVOQxdC1QksDGq/QNpci9KXq48TzqLYDs A0k9lJ5lMhWB/25jBMXaGKwDhqB+M46qbBr5LJfmLB18gXuLIUavfXtyxG7iNgocGL4fU7 d7BaFTd5pZnbxsEdIr741O5xGVAZnDOwXLh8L45cLmTP5K4OSgF4ffxwzAxwHw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792669244; b=eJTVvZaunJAUw2o8P1bbrpsetfpbSjMHb8XZF1HMYN5syaexJ0wkmspxJoyyhwxtwR2Wh+ HTZEY01kghL/xHpg9lzfgaF3Xx4dvWoj9Z4CLzxc8rrWoNm1jYnSiq0XpJmCpCNkPEsaED Se4teFiu4/KcC+9AndMYDgPHewTLyd9gUkGLcip3YX1tAdfyvbGgWQ1fe8WhntkEReAIPA c2YkndQYftnzd5LMevBCYglmUcbxwqEDH/ohcGjFVV8g5pT8wHeMxI4+Oa4xxHEJCjWL/f YQjvM/nDnyxSm0lkBigYhZYNQevmKjH4s501ArSVKPmYHWKlMiMJgQBcs7HHZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792669244; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FFAB8afEAHqDGd6biv4DYJdLi/Fjq/lYGsT21l41ioE=; b=at7pS0CHUL1ylil2vVNkt7L563FYF4LcBFVdVxS9oLWz8pV2HX1+bkNUYb8VYnvKoJW3QE R3N09ZETxzUuqsWP4JZJi2qq6iDq8/koOi02ZrH+CqE5TZjn1A26k2otO3EbvUqMZn7A5F AJ7FalEFFy2+DQSDCkPZvaObmRpRnKGiMca1TmqQpcWY0YIuCoEzt5lB1zW4b0Llr9T2Ds SPgL8epk9Qh8LiKKw/o5HYw1dYv0279l3DKSke6BPUq/DQav7cZZp8UCna6y89X2mX5EEA wRA9Iq1peDEX+upCOl+/G8j2jSA5Uik3tgOqGHQQS1oxKxL9O4QXcnuDw4sEJw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4j9PNX4M3Zzgkh for ; Thu, 22 Oct 2026 11:40:44 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 69MBeikU050585 for ; Thu, 22 Oct 2026 11:40:44 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 69MBeibR050584 for python@FreeBSD.org; Thu, 22 Oct 2026 11:40:44 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" From: bugzilla-noreply@freebsd.org To: python@FreeBSD.org Subject: maintainer-feedback requested: [Bug 299701] devel/py-pip: compromised certificates due to eMudhra incident Date: Thu, 22 Oct 2026 11:40:44 +0000 X-Bugzilla-Type: request X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: python@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback? Message-ID: In-Reply-To: References: X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Archive: https://lists.freebsd.org/archives/freebsd-python X-BeenThere: freebsd-python@freebsd.org Sender: owner-freebsd-python@FreeBSD.org List-Id: FreeBSD-specific Python issues List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Bugzilla Automation has asked freebsd-python (Nobody) for maintainer-feedback: Bug 299701: devel/py-pip: compromised certificates due to eMudhra incident https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D299701 --- Description --- pip bundles its own CA certificates, which it uses in addition to the system certificates. These need to be updated to provent MITM attacks due to the recent eMudhra incident. See discussion: https://discuss.python.org/t/information-for-python-users-regarding-emudhra= -ems ign-ca-certificate-security-incident/109576 The best option might be to do what Debian does and patch pip to only use t= he system certificates: https://salsa.debian.org/python-team/packages/python-pip/-/blob/master/debi= an/p atches/certifi-debian-ca-certificates.patch?ref_type=3Dheads Otherwise pip needs to be updated to a version that includes an updated certificate bundle.