New Python security updates explicitly block the eMudhra certificates by SPKI

Python shipped security updates that explicitly distrust eMudhra certificates by matching their Subject Public Key Information (SPKI) against a hard-coded list of SHA-256 digests, `_distrusted_spki[][SHA256_DIGEST_LENGTH]`. The patch was contributed by former Python core developer Christian Heimes, with Claude assistance, and flagged on the Python discussion forums by core developer and Python 3.14/3.15 release manager Hugo van Kemenade. Code comments call the blocklist "an extraordinary measure and last line of defense," noting that removing trust is primarily the job of the platform root store and that the list only blocks keys while that update propagates to operating systems, container images, or root CAs bundled in Python packages.

Thanks to Python core developer and Python 3.14 and 3.15 release manager Hugo van Kemenade on the main Python discussion forums for the heads-up 0 . The patch 1 is contributed by Christian Heimes with Claude assistance , former core developer who spearheaded the discussion on the bug tracker 2 and quickly affirmed the seriousness of the problem in the discussion thread post 2, which corrected my mistaken assumption that pip would ignore its bundled certifi certificates as long as truststore was able to find system certificates . Blocking is implemented by a pretty straightforward loop, memcmp'ing against the hard-coded unsigned char distrusted spki SHA256 DIGEST LENGTH . As explained in comments: This is an extraordinary measure and last line of defense. Removing trust is primarily the job of the platform root store. This list only blocks keys while that update is still propagating to the OS, container images, or root CAs bundled in Python packages. The threshold for adding an entry is very high. There's also an amusing workaround for security scanners that might trip on the tests included in the source release. From the code comment: The distrusted test material… lives in a password-protected zip so it doesn't trip security scanners that cannot tell internal test fixtures from production secrets and flag any certificate or private key they find. It is encrypted, not merely zipped, because such scanners read inside plain archives. The password is fixed, public, and not a secret. What might that non-secret password be, you ask? Well, this is Python, so of course: DISTRUSTED ZIP CHOSEN KNIGHT = 'Brave Sir Robin' 0 : https://discuss.python.org/t/ /109576/60 1 : https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 2 : https://github.com/python/cpython/issues/160040 Comments URL: https://news.ycombinator.com/item?id=50255510 https://news.ycombinator.com/item?id=50255510 Points: 1 Comments: 0