Skip to content

Require certifi >= 2026.10.19 for the emSign/eMudhra CA compromise #1227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stevemessick merged 1 commit into from
Oct 21, 2026
Merged

Require certifi >= 2026.10.19 for the emSign/eMudhra CA compromise #1227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ Changelog

### Next

* Require `certifi >= 2026.10.19`, which drops the compromised emSign/eMudhra root CAs ([GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2)). `kaggle` only pulled in certifi through `requests`, which sets no minimum, so an existing install could keep a certifi that would accept a forged kaggle.com certificate and leak the user's API token to a man-in-the-middle
* Report a 404 from `kaggle competitions submit` with a competition-specific hint on stderr, naming the notebook and version for code submissions. The check never matched a 404, so users got the generic `<owner>/<slug>` hint instead
* Exit non-zero from `kaggle competitions submit` when the submission file upload fails. It printed "Could not submit to competition" and exited 0, so scripts treated the failed submission as a success
* Stream `kaggle kernels output` files to disk through the same download path as datasets and competitions, with a read timeout, a size check, and resume after a dropped connection. Each file used to be read into memory whole, so a 512 MiB output took about 1.2 GB of RAM, and a dropped connection failed the command and left an empty file behind
Expand Down
2 changes: 2 additions & 0 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ dependencies = [
"kagglesdk >= 0.1.37, < 1.0", # sync with kagglehub
"python-slugify",
"requests",
# requests sets no certifi floor; older bundles trust the compromised emSign/eMudhra roots (GHSA-6q48-6c7w-9gw2).
"certifi >= 2026.10.19",
"python-dateutil",
"tqdm",
"urllib3 >= 1.15.1",
Expand Down
4 changes: 3 additions & 1 deletion requirements.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ attrs==26.1.0
bleach==6.3.0
# via kaggle (pyproject.toml)
certifi==2026.10.19
# via requests
# via
# kaggle (pyproject.toml)
# requests
charset-normalizer==3.4.6
# via requests
fastjsonschema==2.21.2
Expand Down
5 changes: 3 additions & 2 deletions tools/cicd/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,9 @@ ARG PYTHON_VERSION

FROM python:${PYTHON_VERSION}

RUN python -m pip install --upgrade pip
# Pick up the emSign/eMudhra CA removal (GHSA-6q48-6c7w-9gw2) in the OS trust store and Python tooling.
RUN apt-get update && apt-get install -y --only-upgrade ca-certificates && rm -rf /var/lib/apt/lists/*

RUN python -m pip install hatch==1.16.5
RUN python -m pip install --upgrade "pip>=26.2.2" "certifi>=2026.10.19" hatch==1.16.5

ENTRYPOINT ["hatch"]
Loading