Hi Paul,
On 10/24/26 10:47, Paul Barker wrote:
On Fri, 2026-10-23 at 23:10 +0200, Jeroen Hofstee wrote:
Hello Paul, sorry again,
pip has the same problem,
https://github.com/victronenergy/openembedded-core/commit/867c6f1f48bf8bec3a6b394dcde26f97ba1413a7
Hi Jeroen,
It goes much further than this! If you want the full horror then look at
the NixOS tracking issue [1]. They identified 883 packages in their
collection which embed a copy of the CA certificate store. We probably
have less than that, certainly in OE-core, but getting this fixed fully
is going to take time.
For python3-pip blacksail is on v26.2.1, and v26.2.2 is just a fix for
this single security issue we can cherry-pick that to blacksail easily.
For wrynose & scarthgap though we need a targeted backport patch. What
you have in your victronenergy fork of OE-core looks right - please
could you submit that to the list for wrynose & scarthgap?
[1]: https://github.com/NixOS/nixpkgs/issues/576475
Yes, this is worse than I would have guessed. This pip showed up
in a local scan, which already surprised me. As zipped copy of that
surprised, inside python, surprised me even more. (it is in
python3-misc if you are looking for it).
The interpreters and libraries seem to actively add code to revoke
them. It is a bit of a pity that that is required.
Anyway, I submitted the wrynose version and will see if it gets merged.
I can easily submit the scarthgap version as well.
With kind regards,
Jeroen
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#249074):
https://lists.openembedded.org/g/openembedded-core/message/249074
Mute This Topic: https://lists.openembedded.org/mt/121898134/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
