Repository navigation
backport CVE-2026-115557 fix (distrust compromised eMudhra CA keys) - #279
Conversation
Python 3.10 reached end of life without a fixed release for CVE-2026-115557 (gh-160040), so backport the 3.11 fix (7dd8b4736a1419750b94a388e6d158be15836fe6) as a source patch: distrust compromised eMudhra intermediate CA keys. Adds a regression test that checks a peer chain signed by a distrusted intermediate is rejected with X509_V_ERR_CERT_REJECTED.
win-arm64 is now part of the default build matrix (package-build-platform#3947, AnacondaRecipes/aggregate#703), but it ships Python >=3.12 only. Skip both outputs so the 3.10 recipe does not attempt win-arm64.
🔴 Mergeability confidence: 0/100 (concern) — 2 reviewers recommended66 checks · 31 passed · 6 warnings · 4 critical Categorization
(truncated — see full report) - 🟡 **no-setup-py-script** — Package 'python' has no inline build script; external build scripts (build.sh/bld.bat) were not analyzed.Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) Needs attentionlibpython-static
(truncated — see full report) python
(truncated — see full report) - 🔴 **not-cbc-pinned** — Package 'python' is pinned in the aggregate conda_build_config.yaml. Changes to CBC-pinned packages can cascade across the ecosystem and require careful review.Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) unknown
(truncated — see full report) - 🟡 **build-log-warnings** — Build log contains 1 unique network-access-during-build warning(s) (1 total occurrences): Network access detected during build (unreproducible builds) Open the build log and confirm warnings are benign.Evidence(truncated — see full report) Evidence(truncated — see full report) Evidence(truncated — see full report) Could not determine
Analysed channel: Automated signals — not an approval. Verify flagged items before merging. |
python 3.10.22 - backport fix for CVE-2026-115557
Destination channel: defaults
Links
Explanation of changes:
7dd8b4736a1419750b94a388e6d158be15836fe6) to 3.10 as source patch 0030. 3.10 is end-of-life and has no upstream fixed release for this CVE.Modules/_ssl/distrusted_spki.h) and a verify callback inModules/_ssl.cthat rejects chains containing them.anaconda.yamlfor version tracking.win-arm64: it ships Python >=3.12 only, so Python 3.10 is not built there.build_numberto 1.