On Fri, 2026-10-23 at 23:10 +0200, Jeroen Hofstee wrote: > Hello Paul, sorry again, > > pip has the same problem, > https://github.com/victronenergy/openembedded-core/commit/867c6f1f48bf8bec3a6b394dcde26f97ba1413a7
Hi Jeroen, It goes much further than this! If you want the full horror then look at the NixOS tracking issue [1]. They identified 883 packages in their collection which embed a copy of the CA certificate store. We probably have less than that, certainly in OE-core, but getting this fixed fully is going to take time. For python3-pip blacksail is on v26.2.1, and v26.2.2 is just a fix for this single security issue we can cherry-pick that to blacksail easily. For wrynose & scarthgap though we need a targeted backport patch. What you have in your victronenergy fork of OE-core looks right - please could you submit that to the list for wrynose & scarthgap? [1]: https://github.com/NixOS/nixpkgs/issues/576475 Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248585): https://lists.openembedded.org/g/openembedded-core/message/248585 Mute This Topic: https://lists.openembedded.org/mt/121898134/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
