GHSA-5xjx-3w67-w9x9

pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI

Published

2026-10-30

Modified

2026-10-30

Sources

github-advisory

Summary

### Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the `emSign` root CA trust store certificate through the `certifi` distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://github.com/marketplace/actions/pypi-publish ### Details The `certifi`-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that [pypi-publish] relies on for Trusted Publishing and Digital Attestations. ### Related The external compromise is being tracked at https://emudhra.we-have-a-problem.com

Affected packages

Remediation: Upgrade to 1.14.3 or later.

References

• https://github.com/advisories/GHSA-5xjx-3w67-w9x9