{"slug": "new-python-security-updates-explicitly-block-the-emudhra-certificates-by-spki", "title": "New Python security updates explicitly block the eMudhra certificates by SPKI", "summary": "Python shipped security updates that explicitly distrust eMudhra certificates by matching their Subject Public Key Information (SPKI) against a hard-coded list of SHA-256 digests, `_distrusted_spki[][SHA256_DIGEST_LENGTH]`. The patch was contributed by former Python core developer Christian Heimes, with Claude assistance, and flagged on the Python discussion forums by core developer and Python 3.14/3.15 release manager Hugo van Kemenade. Code comments call the blocklist \"an extraordinary measure and last line of defense,\" noting that removing trust is primarily the job of the platform root store and that the list only blocks keys while that update propagates to operating systems, container images, or root CAs bundled in Python packages.", "body_md": "Thanks to Python core developer (and Python 3.14 and 3.15 release manager) Hugo van Kemenade on the main Python discussion forums for the heads-up[0]. The patch[1] is contributed by Christian Heimes (with Claude assistance), former core developer who spearheaded the discussion on the bug tracker[2] and quickly affirmed the seriousness of the problem in the discussion thread (post 2, which corrected my mistaken assumption that pip would ignore its bundled `certifi` certificates as long as `truststore` was able to find system certificates).\n\nBlocking is implemented by a pretty straightforward loop, memcmp'ing against the hard-coded `unsigned char _distrusted_spki[][SHA256_DIGEST_LENGTH]`. As explained in comments:\n\n* This is an extraordinary measure and last line of defense. Removing trust is * primarily the job of the platform root store. This list only blocks keys while * that update is still propagating to the OS, container images, or root CAs * bundled in Python packages. The threshold for adding an entry is very high.\n\nThere's also an amusing workaround for security scanners that might trip on the *tests* included in the source release. From the code comment:\n\n> The distrusted test material… lives in a password-protected zip so it doesn't trip security scanners that cannot tell internal test fixtures from production secrets and flag any certificate or private key they find. It is encrypted, not merely zipped, because such scanners read inside plain archives. The password is fixed, public, and not a secret.\n\nWhat might that non-secret password be, you ask? Well, this is Python, so of course:\n\n```\n  DISTRUSTED_ZIP_CHOSEN_KNIGHT = 'Brave Sir Robin'\n```\n\n[0]: https://discuss.python.org/t/_/109576/60\n[1]: https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6\n\n[2]: https://github.com/python/cpython/issues/160040\n\nComments URL: [https://news.ycombinator.com/item?id=50255510](https://news.ycombinator.com/item?id=50255510)\n\nPoints: 1\n\n# Comments: 0", "url": "https://wpnews.pro/news/new-python-security-updates-explicitly-block-the-emudhra-certificates-by-spki", "canonical_source": "https://news.ycombinator.com/item?id=50255510", "published_at": "2026-10-27 07:03:55+00:00", "updated_at": "2026-10-27 07:41:45.293785+00:00", "lang": "en", "topics": ["artificial-intelligence"], "entities": ["Python", "eMudhra", "Hugo van Kemenade", "Christian Heimes", "Claude", "Python Software Foundation"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/new-python-security-updates-explicitly-block-the-emudhra-certificates-by-spki", "markdown": "https://wpnews.pro/news/new-python-security-updates-explicitly-block-the-emudhra-certificates-by-spki.md", "text": "https://wpnews.pro/news/new-python-security-updates-explicitly-block-the-emudhra-certificates-by-spki.txt", "jsonld": "https://wpnews.pro/news/new-python-security-updates-explicitly-block-the-emudhra-certificates-by-spki.jsonld"}}