Python developer urges packages to stop vendoring CA roots
Original title: Re: Information for Python users regarding eMudhra / emSign CA certificate security incident
The reply says distribution ca-certificates should be the default, with certifi used as a dependency only when necessary.
In an oss-security reply about the eMudhra and emSign CA certificate incident, Valtteri Vuorikoski argues that Python packages other than certifi should stop vendoring root certificates. He says users should install their distribution's ca-certificates package, and that certifi should be a dependency rather than vendored code. The post does not add new facts about the certificate incident.
Unconfirmed: The snippet is one developer's opinion and does not describe the CA incident itself.
- The author says the system trust store should be the default source of truth.
- certifi should be a dependency, not copied into other packages.
- The message is an opinion reply rather than a new incident report.
From the original article
Posted by Valtteri Vuorikoski on Oct 22 Having spent the day whacking this particular molehill, my strong opinion is that these packages (minus certifi) should stop vendoring roots immediately. Users should install their distro's ca-certificates package or similar.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.