On Mon, 26 Oct 2026 08:11:44 +0900 SASAKI Katuhiro <[email protected]> wrote:
> It has been several days since the announcement of the leak of eMudhra's > intermediate CA certificate, but the security/py-certifi port has not been > updated. > In the discourse on Pytho.org[1], it is stated that "It's important to > immediately upgrade the software packages below (includeing pip and certifi) > to at least the versions specified". > Although an update request has been posted in Bugzilla, the update hasn't > been merged yet. Of course, the review and other procedures are probably > currently underway. > > [1] > https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 > Hi. I found you've filed Bug300077 (not sure why it states devel/py-pip as the targetted port in the subject, though), but I found there's already Bug299779 filed earlier. https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299779 Isn't it sufficient? Or is there any reason that devel/py-pip require holding dedicated certificate that is exactly the same as security/py-certifi provides? Of course, it's OK if you've found a reason that the certificate is needed inside ${WRKDIR} for sanely finish builds. But otherwise, depending on security/py-certifi normally is the good way not to be easily overlooked on upgrading devel/py-pip in the future. Note that I found Bug299779 before I attempted to file a bug, as of reading your post here, for quite trivial patch on preliminary search before submitting. So I did nothing actually. Regards. -- Tomoaki AOKI <[email protected]>
