Thanks to Python core developer (and Python 3.14 and 3.15 release manager) Hugo van Kemenade on the main Python discussion forums for the heads-up0. The patch1 is contributed by Christian Heimes (with Claude assistance), former core developer who spearheaded the discussion on the bug tracker2 and quickly affirmed the seriousness of the problem in the discussion thread (post 2, which corrected my mistaken assumption that pip would ignore its bundled certifi certificates as long as truststore was able to find system certificates).
Blocking is implemented by a pretty straightforward loop, memcmp'ing against the hard-coded unsigned char _distrusted_spki[][SHA256_DIGEST_LENGTH]. As explained in comments:
- This is an extraordinary measure and last line of defense. Removing trust is * primarily the job of the platform root store. This list only blocks keys while * that update is still propagating to the OS, container images, or root CAs * bundled in Python packages. The threshold for adding an entry is very high.
There's also an amusing workaround for security scanners that might trip on the tests included in the source release. From the code comment:
The distrusted test material… lives in a password-protected zip so it doesn't trip security scanners that cannot tell internal test fixtures from production secrets and flag any certificate or private key they find. It is encrypted, not merely zipped, because such scanners read inside plain archives. The password is fixed, public, and not a secret.
What might that non-secret password be, you ask? Well, this is Python, so of course:
DISTRUSTED_ZIP_CHOSEN_KNIGHT = 'Brave Sir Robin'
Comments URL: https://news.ycombinator.com/item?id=50255510
Points: 1