mbox series

[scarthgap,00/19] Disable compromised CA certificates

Message ID 20261023-certs-scarthgap-v1-0-0ba436174193@pbarker.dev
Headers show
Series Disable compromised CA certificates | expand

Message

Paul Barker Oct. 23, 2026, 10:50 a.m. UTC 
These changes update ca-certificates & python3-certifi for scarthgap to
handle the fallout of the recent Emudhra CA certificate compromise.

These patches have already passed testing on the autobuilder, they will
be merged to scarthgap outside of the usual stable review process once
they have landed in blacksail & wrynose.

As a consequence, the build backend for python3-certifi is changed to
python_setuptools_build_meta and support for Python 3.6 (EOL since
2021-12-23) is dropped. Both of these are considered acceptable. See
commit "python3-certifi: upgrade 2025.4.26 -> 2025.6.15" for details.

Branch: https://git.openembedded.org/openembedded-core-contrib/log/?h=pbarker/certs-scarthgap
AB Build: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4976

Signed-off-by: Paul Barker <paul@pbarker.dev>
---
Alexander Kanavin (1):
      python3-certifi: upgrade 2025.8.3 -> 2025.11.12

Leon Anavi (1):
      python3-certifi: Upgrade 2026.1.4 -> 2026.2.25

Paul Barker (2):
      ca-certificates: Disable compromised CA certificates
      Revert "python3-certifi: Fix CVE-2024-39689"

Richard Purdie (2):
      python3-certifi: upgrade 2024.12.14 -> 2025.1.31
      python3-certifi: upgrade 2026.2.25 -> 2026.4.22

Ross Burton (1):
      python3-certifi: upgrade 2026.7.22 -> 2026.10.19

Tim Orling (6):
      python3-certifi: upgrade 2024.2.2 -> 2024.6.2
      python3-certifi: upgrade 2025.4.26 -> 2025.6.15
      python3-certifi: upgrade 2025.7.9 -> 2025.8.3
      python3-certifi: upgrade 2026.4.22 -> 2026.5.20
      python3-certifi: upgrade 2026.5.20 -> 2026.6.17
      python3-certifi: upgrade 2026.6.17 -> 2026.7.22

Wang Mingyu (6):
      python3-certifi: upgrade 2024.6.2 -> 2024.7.4
      python3-certifi: upgrade 2024.7.4 -> 2024.8.30
      python3-certifi: upgrade 2024.8.30 -> 2024.12.14
      python3-certifi: upgrade 2025.1.31 -> 2025.4.26
      python3-certifi: upgrade 2025.6.15 -> 2025.7.9
      python3-certifi: upgrade 2025.11.12 -> 2026.1.4

 .../python/python3-certifi/CVE-2024-39689.patch    | 69 ----------------------
 ...i_2024.2.2.bb => python3-certifi_2026.10.19.bb} |  7 +--
 ...mSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch | 35 +++++++++++
 .../ca-certificates/ca-certificates_20260816.bb    |  1 +
 4 files changed, 38 insertions(+), 74 deletions(-)
---
base-commit: e95fc48cd797a013178c71d374810e2c08917d0f
change-id: 20261023-certs-scarthgap-c5343b3616c2

Best regards,
--  
Paul Barker

Comments

Jeroen Hofstee Oct. 23, 2026, 8:05 p.m. UTC | #1 
Hello Paul,

For what it is worth, [1] should do the same for scarthgap / 
python3-certifi,
but without porting all new versions back. I don't really mind which 
approach
we take.

[1] 
https://github.com/victronenergy/openembedded-core/commit/4b6650b6cf7d5ebcd60a0bd41c7d9bda3a750a21

Regards,
Jeroen

On 10/23/26 12:50, Paul Barker wrote:
> These changes update ca-certificates & python3-certifi for scarthgap to
> handle the fallout of the recent Emudhra CA certificate compromise.
>
> These patches have already passed testing on the autobuilder, they will
> be merged to scarthgap outside of the usual stable review process once
> they have landed in blacksail & wrynose.
>
> As a consequence, the build backend for python3-certifi is changed to
> python_setuptools_build_meta and support for Python 3.6 (EOL since
> 2021-12-23) is dropped. Both of these are considered acceptable. See
> commit "python3-certifi: upgrade 2025.4.26 -> 2025.6.15" for details.
>
> Branch: https://git.openembedded.org/openembedded-core-contrib/log/?h=pbarker/certs-scarthgap
> AB Build: https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/4976
>
> Signed-off-by: Paul Barker <paul@pbarker.dev>
> ---
> Alexander Kanavin (1):
>        python3-certifi: upgrade 2025.8.3 -> 2025.11.12
>
> Leon Anavi (1):
>        python3-certifi: Upgrade 2026.1.4 -> 2026.2.25
>
> Paul Barker (2):
>        ca-certificates: Disable compromised CA certificates
>        Revert "python3-certifi: Fix CVE-2024-39689"
>
> Richard Purdie (2):
>        python3-certifi: upgrade 2024.12.14 -> 2025.1.31
>        python3-certifi: upgrade 2026.2.25 -> 2026.4.22
>
> Ross Burton (1):
>        python3-certifi: upgrade 2026.7.22 -> 2026.10.19
>
> Tim Orling (6):
>        python3-certifi: upgrade 2024.2.2 -> 2024.6.2
>        python3-certifi: upgrade 2025.4.26 -> 2025.6.15
>        python3-certifi: upgrade 2025.7.9 -> 2025.8.3
>        python3-certifi: upgrade 2026.4.22 -> 2026.5.20
>        python3-certifi: upgrade 2026.5.20 -> 2026.6.17
>        python3-certifi: upgrade 2026.6.17 -> 2026.7.22
>
> Wang Mingyu (6):
>        python3-certifi: upgrade 2024.6.2 -> 2024.7.4
>        python3-certifi: upgrade 2024.7.4 -> 2024.8.30
>        python3-certifi: upgrade 2024.8.30 -> 2024.12.14
>        python3-certifi: upgrade 2025.1.31 -> 2025.4.26
>        python3-certifi: upgrade 2025.6.15 -> 2025.7.9
>        python3-certifi: upgrade 2025.11.12 -> 2026.1.4
>
>   .../python/python3-certifi/CVE-2024-39689.patch    | 69 ----------------------
>   ...i_2024.2.2.bb => python3-certifi_2026.10.19.bb} |  7 +--
>   ...mSign-ECC-Root-CA-G3-and-Comodo-AAA-Servi.patch | 35 +++++++++++
>   .../ca-certificates/ca-certificates_20260816.bb    |  1 +
>   4 files changed, 38 insertions(+), 74 deletions(-)
> ---
> base-commit: e95fc48cd797a013178c71d374810e2c08917d0f
> change-id: 20261023-certs-scarthgap-c5343b3616c2
>
> Best regards,
> --
> Paul Barker
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#248517): https://lists.openembedded.org/g/openembedded-core/message/248517
> Mute This Topic: https://lists.openembedded.org/mt/121898134/9720520
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [oe@myspectrum.nl]
> -=-=-=-=-=-=-=-=-=-=-=-
Jeroen Hofstee Oct. 23, 2026, 9:10 p.m. UTC | #2 
Hello Paul, sorry again,

pip has the same problem, 
https://github.com/victronenergy/openembedded-core/commit/867c6f1f48bf8bec3a6b394dcde26f97ba1413a7

Regards,
Jeroen

On 10/23/26 22:05, Jeroen Hofstee wrote:
> Hello Paul,
>
> For what it is worth, [1] should do the same for scarthgap / 
> python3-certifi,
> but without porting all new versions back. I don't really mind which 
> approach
> we take.
>
> [1] 
> https://github.com/victronenergy/openembedded-core/commit/4b6650b6cf7d5ebcd60a0bd41c7d9bda3a750a21
>
> Regards,
> Jeroen
>