From 4cd036f067f04c995caf1f3a5ec328c66db2a825 Mon Sep 17 00:00:00 2001 From: sohier Date: Wed, 21 Oct 2026 16:04:25 +0000 Subject: [PATCH] Floor certifi and pip for emSign CA compromise (GHSA-6q48-6c7w-9gw2) certifi < 2026.10.19 trusts the compromised emSign/eMudhra roots, so a MITM could forge a kaggle.com cert and steal users' API tokens. requests only pulls certifi in without a minimum, so declare an explicit floor to force upgraded installs onto the fixed bundle. The CI/CD image also gets patched pip/certifi and refreshed OS ca-certificates; it takes effect once tools/cicd/cloudbuild.yaml is rerun. The repo has no uv usage, lock files, or changelog to update. BUG=b/575927270 Co-authored-by: kaggle-agent --- pyproject.toml | 2 ++ tools/cicd/Dockerfile | 8 ++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 511228c..c4a5aef 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -22,6 +22,8 @@ keywords = ["Kaggle", "API"] requires-python = ">=3.11" dependencies = [ "requests", + # Pulled in by requests; floor drops the compromised emSign CA (GHSA-6q48-6c7w-9gw2). + "certifi>=2026.10.19", "protobuf", ] diff --git a/tools/cicd/Dockerfile b/tools/cicd/Dockerfile index 5efe0dd7..2d1ec0f 100644 --- a/tools/cicd/Dockerfile +++ b/tools/cicd/Dockerfile @@ -4,8 +4,12 @@ ARG PYTHON_VERSION FROM python:${PYTHON_VERSION} -RUN python -m pip install --upgrade pip +# Pick up the latest OS trust store (emSign/eMudhra CA removal, +# GHSA-6q48-6c7w-9gw2). +RUN apt-get update \ + && apt-get install -y --only-upgrade ca-certificates \ + && rm -rf /var/lib/apt/lists/* -RUN python -m pip install build==1.3.0 twine==6.2.0 +RUN python -m pip install --upgrade "pip>=26.2.2" "certifi>=2026.10.19" build==1.3.0 twine==6.2.0 ENTRYPOINT ["python3"] \ No newline at end of file