Repository navigation
Raise the certifi trust floor (2.9.1) - #197
Conversation
|
|
Publication dependency for the prepared OIDC-only workflow: the PyPI project needs a GitHub Trusted Publisher with these exact fields:
The existing upload token receives HTTP 403 from the project management endpoint; it is not a project-settings credential. The account owner has been asked to add the publisher at PyPI project publishing settings. No password/token needs to be shared. This is a registry-side configuration dependency, not a request for routine code review. Normal CI and the other security fixes continue independently. The workflow has no long-lived-token fallback, and the old credential will be revoked only after the first successful OIDC publication is verified. |
|
Merged normally at 5cd660f, exactly the qualified 46149c1 tree. All applicable normal checks pass, including unchanged-source central-policy and portal repeats. The merged remote branch is verified absent. Source delivery is complete; package delivery remains open on durable-workflow/.github#237. No 2.9.1 tag or PyPI upload has been attempted while the required Trusted Publisher configuration is pending. Once configured, use the maintained OIDC-only publisher, verify published hashes and a real installed upgrade from affected certifi, then retire the old upload credential. Original failures remain unsuccessful. |
2 participants
Security fix
Refs durable-workflow/.github#237 and GHSA-6q48-6c7w-9gw2.
Require
certifi>=2026.10.19explicitly. An already installed older certifi currently satisfies httpx's dependency; upgrading this SDK must also upgrade that affected trust bundle. Prepare compatible 2.9.1 metadata and release notes. Normal TLS verification and explicit private-CA configuration remain unchanged.An isolated install starts with affected
certifi==2026.7.22, then installs this candidate: pip removes that version and selects fixed2026.10.19. Final exact head 46149c1 passes all applicable normal checks: Python 3.10/3.11/3.12, integration, package, lint, mypy, corpus, throughput advisory, central policy, target qualification, developer portal, CodeQL, boundary and Sonar. Sonar reports zero OPEN/CONFIRMED issues.The additional local Python 3.13 full run is retained as failed: 3123 passed, 107 skipped, four checkout tests and two scanner setups lacked Git, and one prepared-group test missed its callback marker. An unchanged isolated repeat of that entire 21-test group passes; the first full-run callback failure remains unexplained. Local ruff passes. An extra offline packaging attempt lacked setuptools and is runner-blocked; hosted package validation passes. No SDK implementation, deadline, assertion or skip policy was changed for this patch.
The build/install path bootstraps fixed pip trust using the reviewed SHA-pinned action before networked pip installation in CI/docs/publication. The protected PyPI publication job uses short-lived OIDC credentials, with
id-token: writeconfined to that job and no password-secret fallback. Digest-bound producer artifact validation and exact source/version checks remain. The coordinated central policy change is merged; the original preflight failure is preserved and its unchanged-head repeat passes.The dependency-only candidate 771a3ca first exceeded its unchanged portal limit during Chromium installation; its same-head repeat passed. The final workflow-extension candidate separately encountered stalled Ubuntu package downloads, was canceled before the portal build, and its unchanged-head repeat passed. Those originals remain unsuccessful. No callback assertion, workflow execution budget or browser timeout was relaxed.
Source is ready for merge. Publication remains dependent on the one-time PyPI Trusted Publisher configuration. Do not create the immutable 2.9.1 tag until that configuration is present. Exact PyPI provenance, installed upgrade acceptance and retirement of the old upload token follow successful OIDC publication. This is not evidence of interception, and a caller-supplied SSL context still controls its own trust store.