(Since the mailing list address wasn't included in the 'cc:' field, I've made the changes and resend.) Hi.
On Mon, 26 Oct 2026 19:53:49 +0900 Tomoaki AOKI <[email protected]> wrote: > On Mon, 26 Oct 2026 08:11:44 +0900 > SASAKI Katuhiro <[email protected]> wrote: > > > It has been several days since the announcement of the leak of eMudhra's > > intermediate CA certificate, but the security/py-certifi port has not been > > updated. > > In the discourse on Pytho.org[1], it is stated that "It's important to > > immediately upgrade the software packages below (includeing pip and certifi) > > to at least the versions specified". > > Although an update request has been posted in Bugzilla, the update hasn't > > been merged yet. Of course, the review and other procedures are probably > > currently underway. > > > > [1] > > https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 > > > > Hi. > > I found you've filed Bug300077 (not sure why it states devel/py-pip > as the targetted port in the subject, though), but I found there's > already Bug299779 filed earlier. > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=299779 > > Isn't it sufficient? Or is there any reason that devel/py-pip > require holding dedicated certificate that is exactly the same > as security/py-certifi provides? > I thought that pip would prioritize using the bundled certifi package, but I hadn't actually verified that. So, I actually ran the test script (attached). With the unpatched pip says "TLS verification: SUCCESS" with the problematic site, whereas patched pip says "TLS verification: FAILED". Note that the py-certifi package has already been installed. I just hope I haven't fundamentally misunderstood something... > Of course, it's OK if you've found a reason that the certificate > is needed inside ${WRKDIR} for sanely finish builds. But otherwise, > depending on security/py-certifi normally is the good way not to > be easily overlooked on upgrading devel/py-pip in the future. > I pulled myself together and wrote a patch. All it did was replace 'pip._vendor.certifi' to 'certifi', remove the bundled 'certifi' package, and add a dependency on 'security/py-certifi'. I haven't been able to run a proper test yet, but it looks like the 'download' and 'install' commands are working. However, since this would significantly change how pip works, I don't think it would be accepted. Kind regards, -- SASAKI Katuhiro mailto: [email protected]
#!/usr/bin/env python3 import pip from pip._internal.commands import create_command URL = "https://dv-g3b-emudhra.we-have-a-problem.com/"; cmd = create_command("install") options, args = cmd.parse_args([ "--disable-pip-version-check" ]) session = cmd._build_session(options) print("pip version:", pip.__version__) print("verify:", session.verify) try: response = session.get(URL, timeout=15) print("TLS verification: SUCCESS") print("HTTP status:", response.status_code) except Exception as e: print("TLS verification: FAILED") print(type(e).__name__, e) finally: session.close()
diff -urN ../py-pip.orig/Makefile ./Makefile --- ../py-pip.orig/Makefile 2026-11-02 11:15:55.120561000 +0900 +++ ./Makefile 2026-11-02 10:47:33.229963000 +0900 @@ -1,6 +1,6 @@ PORTNAME= pip PORTVERSION= 23.3.2 -PORTREVISION= 4 +PORTREVISION= 5 CATEGORIES= devel python MASTER_SITES= https://files.pythonhosted.org/packages/c3/9e/8a7ba2c9984a060daa6c6f9fff4d576b7ace3936239d6b771541eab972ed/:test_setuptools \ https://files.pythonhosted.org/packages/61/86/cc8d1ff2ca31a312a25a708c891cf9facbad4eae493b3872638db6785eb5/:test_wheel @@ -29,6 +29,7 @@ ${PYTHON_PKGNAMEPREFIX}virtualenv>=0:devel/py-virtualenv@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}werkzeug>=0:www/py-werkzeug@${PY_FLAVOR} \ ${PYTHON_PKGNAMEPREFIX}wheel>=0:devel/py-wheel@${PY_FLAVOR} \ + ${PYTHON_PKGNAMEPREFIX}certifi>=0:security/py-certifi@${PY_FLAVOR} \ hg:devel/mercurial \ git:devel/git .if ${WITH_SUBVERSION_VER:U} == LTS @@ -50,6 +51,8 @@ SHEBANG_FILES= src/pip/__init__.py +RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}certifi>=0:security/py-certifi@${PY_FLAVOR} + # DOCS is broken with sphinx 9.0.4. # OPTIONS_DEFINE= DOCS @@ -66,6 +69,7 @@ post-patch: @${RM} -r ${WRKSRC}/src/pip/_vendor/colorama/tests/ + @${RM} -r ${WRKSRC}/src/pip/_vendor/certifi/ post-install-DOCS-on: @${MKDIR} ${STAGEDIR}${DOCSDIR} diff -urN ../py-pip.orig/files/patch-certifi ./files/patch-certifi --- ../py-pip.orig/files/patch-certifi 1970-01-01 09:00:00.000000000 +0900 +++ ./files/patch-certifi 2026-10-31 00:09:35.034069000 +0900 @@ -0,0 +1,68 @@ +diff -urN ../pip-23.3.2.orig/setup.py ./setup.py +--- ../pip-23.3.2.orig/setup.py 2023-12-17 21:35:15.000000000 +0900 ++++ ./setup.py 2026-10-30 23:48:02.832915000 +0900 +@@ -62,7 +62,6 @@ + package_data={ + "pip": ["py.typed"], + "pip._vendor": ["vendor.txt"], +- "pip._vendor.certifi": ["*.pem"], + "pip._vendor.requests": ["*.pem"], + "pip._vendor.distlib._backport": ["sysconfig.cfg"], + "pip._vendor.distlib": [ +diff -urN ../pip-23.3.2.orig/src/pip/_internal/build_env.py ./src/pip/_internal/build_env.py +--- ../pip-23.3.2.orig/src/pip/_internal/build_env.py 2023-12-17 21:35:15.000000000 +0900 ++++ ./src/pip/_internal/build_env.py 2026-10-30 23:48:51.683650000 +0900 +@@ -11,7 +11,7 @@ + from types import TracebackType + from typing import TYPE_CHECKING, Iterable, List, Optional, Set, Tuple, Type, Union + +-from pip._vendor.certifi import where ++from certifi import where + from pip._vendor.packaging.requirements import Requirement + from pip._vendor.packaging.version import Version + +diff -urN ../pip-23.3.2.orig/src/pip/_internal/commands/debug.py ./src/pip/_internal/commands/debug.py +--- ../pip-23.3.2.orig/src/pip/_internal/commands/debug.py 2023-12-17 21:35:15.000000000 +0900 ++++ ./src/pip/_internal/commands/debug.py 2026-10-30 23:49:26.622693000 +0900 +@@ -8,7 +8,7 @@ + from typing import Any, Dict, List, Optional + + import pip._vendor +-from pip._vendor.certifi import where ++from certifi import where + from pip._vendor.packaging.version import parse as parse_version + + from pip._internal.cli import cmdoptions +@@ -193,7 +193,7 @@ + show_value("'cert' config value", ca_bundle_info(self.parser.config)) + show_value("REQUESTS_CA_BUNDLE", os.environ.get("REQUESTS_CA_BUNDLE")) + show_value("CURL_CA_BUNDLE", os.environ.get("CURL_CA_BUNDLE")) +- show_value("pip._vendor.certifi.where()", where()) ++ show_value("certifi.where()", where()) + show_value("pip._vendor.DEBUNDLED", pip._vendor.DEBUNDLED) + + show_vendor_versions() +diff -urN ../pip-23.3.2.orig/src/pip/_vendor/requests/certs.py ./src/pip/_vendor/requests/certs.py +--- ../pip-23.3.2.orig/src/pip/_vendor/requests/certs.py 2023-12-17 21:35:15.000000000 +0900 ++++ ./src/pip/_vendor/requests/certs.py 2026-10-30 23:49:57.374994000 +0900 +@@ -15,7 +15,7 @@ + import os + + if "_PIP_STANDALONE_CERT" not in os.environ: +- from pip._vendor.certifi import where ++ from certifi import where + else: + def where(): + return os.environ["_PIP_STANDALONE_CERT"] +diff -urN ../pip-23.3.2.orig/tests/functional/test_debug.py ./tests/functional/test_debug.py +--- ../pip-23.3.2.orig/tests/functional/test_debug.py 2023-12-17 21:35:15.000000000 +0900 ++++ ./tests/functional/test_debug.py 2026-10-30 23:48:28.190574000 +0900 +@@ -21,7 +21,7 @@ + "'cert' config value: ", + "REQUESTS_CA_BUNDLE: ", + "CURL_CA_BUNDLE: ", +- "pip._vendor.certifi.where(): ", ++ "certifi.where(): ", + "pip._vendor.DEBUNDLED: ", + "vendored library versions:", + ],
