[anth-volk]

Why

On 2026-10-20 it was disclosed that eight eMudhra (emSign) intermediate CA certificates were issued with private keys small enough to recover from the public certificates (https://emudhra.we-have-a-problem.com). Anyone can use them to issue a certificate for any domain, so a client that still trusts the "emSign ECC Root CA - G3" root can be served a forged certificate by someone on the network path. Browsers and operating systems already block these intermediates; software that carries its own CA list, such as Python's certifi, needs an update.

What in this repository trusted the affected root

• uv.lock locked certifi 2026.7.22, which includes "emSign ECC Root CA - G3". certifi 2026.10.19 is the first release without it.
• The emitter makes its HTTPS requests with httpx 0.28.1, which verifies certificates against certifi's bundle by default. It sends them to the telemetry collector (https://microcosm-telemetry-389282473430.us-central1.run.app, src/microcosm_emitter/core/constants.py) and to the Orrery publication origin (https://microcosm-runs.vercel.app, src/microcosm_emitter/orrery/service/queue.py). huggingface-hub also uses httpx. No code sets verify=False, a custom CA bundle, or a CA environment variable.
• uv.lock locks hf-xet 1.7.0. Releases from 1.4.3 onward use the operating-system CA store rather than a compiled-in list, so hf-xet needs no change.
• The lockfile applies to CI (uv sync --locked in ci.yml and tools/check-collector.sh) and to local development from a checkout. uv tool install microcosm-emitter resolves its own dependency versions and does not read this lockfile.

Changes

• uv.lock: certifi 2026.7.22 -> 2026.10.19, produced with uvx uv@0.13.4 lock --upgrade-package certifi. uv 0.13.4 is the version CI installs: setup-uv has no version input and pyproject.toml sets no required-version, so CI uses the newest uv release. No other package changed.
• changelog.d/emudhra-ca-trust-update.fixed.md: a "fixed" fragment, as tools/check-changelog.sh requires. When merged, it produces patch release 0.5.1.

Checks

• uv lock --locked (uv 0.13.4): passes, 54 packages resolved.
• python tools/bump-version.py --check: passes, 0.5.0 -> 0.5.1.
• uv sync --locked, then the commands in tools/check-quality.sh (ruff check ., ruff format --check ., bash -n tools/*.sh): all pass.
• httpx 0.28.1 against the incident test endpoints:
  • Python from the environment synced with the updated lockfile (certifi 2026.10.19): both https://dv-g3b-emudhra.we-have-a-problem.com/ and https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ fail with CERTIFICATE_VERIFY_FAILED, so the client is protected.
  • A temporary environment with the previous pin (certifi 2026.7.22): https://dv-g3b-emudhra.we-have-a-problem.com/ returned HTTP 200, so the client trusted the compromised intermediate. The Sectigo cross-signed endpoint was already rejected.
• I did not run the full test suite; CI runs it.

Operator actions after merge

• Merging starts push.yaml, which bumps the version to 0.5.1 and publishes it to PyPI. The published wheel has the same dependency ranges as before, since it does not include the lockfile.
• Anyone who installed the emitter with uv tool install microcosm-emitter before 2026-10-20 02:24 UTC, when certifi 2026.10.19 was published, has an older certifi in that tool environment. Run uv tool upgrade microcosm-emitter to update it and its dependencies. Check the installed tool environment with "$(uv tool dir)/microcosm-emitter/bin/python" -c "import certifi; print(certifi.__version__)" (on Windows, Scripts\python.exe in place of bin/python), which should print 2026.10.19 or later.
• Developers with existing checkouts should run uv sync after pulling.

This PR does not change workflows, container definitions or other deployment code, so it reads or declares no environment variables.

🤖 Generated with Claude Code