mirror of
https://github.com/python/cpython.git
synced 2026-10-28 18:35:21 +08:00
Christian HeimesandClaude Opus 4.8
7dd8b4736a
The ssl module now rejects TLS certificate chains that contain any of a set of compromised eMudhra intermediate CA keys. This is an extraordinary measure and a last line of defense: removing trust is primarily the job of the platform root store, and the built-in denylist only blocks connections while that update has not yet reached the OS, a container image, or a bundled trust store in various Python packages. Entries are added to the denylist only under a very high threshold. The denylist matches on the public key (the SHA-256 digest of the RFC-5280 SubjectPublicKeyInfo), so it also covers the cross-signed certificates that reuse one of the distrusted keys. --------- Signed-off-by: Christian Heimes <christian@python.org> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>