Information for Python users regarding eMudhra / emSign CA certificate security

A security incident involving eMudhra's emSign intermediate certificates forced removal of the emSign root from CA bundles such as certifi because compromised intermediates can enable man-in-the-middle attacks against TLS clients, including python.org and pypi.org. Immediate upgrades are required: certifi to 2026.10.19, pip to at least 26.2.2, uv 0.13.4, sigstore 4.5.1, and pixi 0.82.1; container images and all virtual environments should be rebuilt or updated. The discussion supplies concrete upgrade commands (including a direct pip wheel URL and macOS python.org-specific invocations) and a POSIX shell script to find and update multiple Python installs. Users are warned that pip always loads its vendored certifi in addition to the system trust store, so updating pip itself is essential because environment variables that add CAs do not disable pip’s bundled bundle.

Responses cover technical mitigations and ecosystem actions: Debian patched its packaged pip to use the system CA store and shipped an OS ca-certificates update; manylinux/cibuildwheel images were refreshed but some official Docker images still ship vulnerable pip. Golang implemented SPKI-based filtering and a CPython change proposes adding a small denylist in the ssl module to reject certificate chains whose SubjectPublicKeyInfo matches compromised keys as defense in depth. Community threads request clear guidance for distribution-packaged pip, simple explanations for general programmers, and short-term mitigations (for example, setting PIP_CERT or using updated base images) while root-store updates propagate.