From 3ea48563010312aefc632570bcfb82872f0d7489 Mon Sep 17 00:00:00 2001 From: mday-io Date: Fri, 23 Oct 2026 04:59:39 +0000 Subject: [PATCH] ci: publish with a pip that excludes the compromised eMudhra/emSign CA The publish job ran on Python 3.10, whose bundled pip still trusts the compromised eMudhra/emSign root. Build and upload on Python 3.13, whose latest patch bundles pip 26.2.2+, and fail the job if pip is older. Signed-off-by: mday-io --- .github/workflows/release.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 47fdd9ac7a..a3e3e820e3 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -40,9 +40,13 @@ jobs: - name: Set up Python uses: actions/setup-python@v7 with: - python-version: '3.10' + # 3.13.17+ bundles pip 26.2.2+, which no longer trusts the compromised eMudhra/emSign root CA. + python-version: '3.13' - name: Install uv uses: astral-sh/setup-uv@v7 + - name: Check pip includes the eMudhra/emSign CA removal + run: | + python -c "import sys, pip; v = tuple(int(p) for p in pip.__version__.split('.')[:3]); sys.exit(0 if v >= (26, 2, 2) else f'pip {pip.__version__} predates the eMudhra/emSign CA removal; need >= 26.2.2')" - name: Install build dependencies run: pip install build twine setuptools_scm - name: Publish Python package