[icanhasmath]

Security release pip 20.3.4.post4 for the Python 2.7 line. Follow-up to GHSA-6q48-6c7w-9gw2, the eMudhra/emSign CA key compromise.

Change

• certifi: the vendored copy moves from 2026.10.19.post1 to 2026.10.23.post1, which is ActiveState/certifi 2026.10.23.post1. Its cacert.pem is byte-identical to upstream certifi 2026.10.23's.
• Removed roots: this drops emSign Root CA - C1 and emSign ECC Root CA - C3. The previous release already removed emSign ECC Root CA - G3, so emSign Root CA - G1 is now the only emSign root in the bundle.
• What changed in the package: only cacert.pem and the certifi version (in __init__.py and vendor.txt). pip's certifi patches are unchanged. The pip version is bumped to 20.3.4.post4, and NEWS.rst gets the release entry.

Validation (in python:2.7-slim)

• Build and install: I built the sdist and wheel the same way as the previous release and installed the wheel into a fresh environment. pip --version reports 20.3.4.post4.
• Vendored certifi: it reports 2026.10.23.post1, the bundle has 118 roots and the only emSign root is G1, and certifi.contents() works.
• Network: pip download six==1.16.0 from PyPI works.
• Comparison with the previous release's assets:
  • Wheel: identical apart from pip/__init__.py, pip/_vendor/certifi/__init__.py, pip/_vendor/certifi/cacert.pem and pip/_vendor/vendor.txt, plus RECORD and the Version: line in METADATA.
  • sdist: changes the same four files, plus NEWS.rst and PKG-INFO.

After merge: tag 20.3.4.post4 and publish a GitHub release with the wheel and sdist.

[ezequielp-activestate]

No blockers. The vendored cacert.pem is byte-identical to the one in certifi 2026.10.23 on PyPI (sha256 2ef52ad5…). Against the base branch it removes exactly two roots, emSign Root CA - C1 and emSign ECC Root CA - C3, and adds none, leaving emSign Root CA - G1 as the only emSign root, as the changelog says. The pip version, the vendored certifi __version__ (2026.10.23.post1) and vendor.txt agree. That ActiveState certifi release exists with its wheel and sdist attached. On Python 2.7.18, this tree's pip reports 20.3.4.post4, certifi where() points at the vendored bundle, and pip download six==1.16.0 from PyPI succeeds over TLS through it.