[anth-volk]

Fixes #380

Summary

On 2026-10-20 it was disclosed that eight intermediate CA certificates operated by eMudhra (emSign brand) have private keys that can be recovered from the public certificates, so anyone can issue a certificate for any domain under them. Six TLS intermediates chain to the root "emSign ECC Root CA - G3", and all eight were also cross-signed under Sectigo's "AAA Certificate Services". Software that carries its own CA list and has not been updated still trusts them. Details: https://emudhra.we-have-a-problem.com

What in this repository trusted the affected root. uv.lock pinned certifi 2025.11.12, which includes "emSign ECC Root CA - G3" (certifi 2026.10.19 removes it). httpx 0.28.1 verifies TLS against certifi's CA list by default, and this repository uses httpx for:

• chronicle/artifacts.py and chronicle/source_package.py: downloading publisher artifacts from manifest source_urls, including scripts/fetch_r2_only_source_artifacts.py, which CI runs before the tests;
• db/supabase_client.py: the Supabase Python client, which sends its API key over httpx.

I established this from the lockfile and the code paths above. No code in the repository disables certificate verification or sets a custom CA bundle (searched for verify=, SSL_CERT_FILE, REQUESTS_CA_BUNDLE, ssl_ca, cafile and similar). The repository has no Dockerfile, Modal app or Vercel project, so the lockfile affects CI and local development only.

Changes

• uv.lock: certifi 2025.11.12 -> 2026.10.19, made with uvx uv@0.13.4 lock --upgrade-package certifi. uv 0.13.4 is the newest uv release and the version astral-sh/setup-uv@v5 installs in CI, since the workflows do not pin a uv version. That uv version also raised the lockfile revision field from 3 to 5. No other package changed.
• changelog.d/emudhra-ca-trust-update.fixed.md: changelog fragment.

Chronicle Governance

This PR does not touch the Chronicle source-data boundary: no source package, consumer contract or schema changes.

Tests

• uvx uv@0.13.4 lock --locked: passes. uv lock --locked with uv 0.12.23 also passes.
• uv sync --locked --all-extras with uv 0.13.4 into a temporary environment: installs.
• httpx 0.28.1 in that locked environment (certifi 2026.10.19):
  • https://dv-g3b-emudhra.we-have-a-problem.com/ -> CERTIFICATE_VERIFY_FAILED
  • https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ -> CERTIFICATE_VERIFY_FAILED
  • https://pypi.org/simple/certifi/ -> HTTP 200
• httpx 0.28.1 with the previous certifi 2025.11.12, for comparison:
  • https://dv-g3b-emudhra.we-have-a-problem.com/ -> HTTP 200, so the previous lockfile trusted the compromised chain
  • https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ -> CERTIFICATE_VERIFY_FAILED
• I did not run the test suite locally; CI runs it.

After merge

• No deployment needs rebuilding; nothing in this repository is deployed.
• Contributors pick up the new certifi the next time they run uv sync on an updated main.

Environment variables: this PR does not change CI workflows or deployment code and adds no environment variables.

🤖 Generated with Claude Code