Repository navigation
Conversation
The publish job ran on Python 3.10, whose bundled pip still trusts the compromised eMudhra/emSign root. Build and upload on Python 3.13, whose latest patch bundles pip 26.2.2+, and fail the job if pip is older. Signed-off-by: mday-io <mdaytn@gmail.com>
64a6bc0 to
3ea4856
Compare
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Configure publish environment .github/workflows/release.yaml |
The publish job uses Python 3.13. It exits with an error if pip is older than 26.2.2. |
Priority:
Estimated code review effort: 2 (Simple) | ~8 minutes
Change: Other
Suggested reviewers: eakmanrq
Merge Risk: 
3ea48
-
The release job is expected to use the selected Python runtime and proceed when its pip meets the required version. No actionable merge-blocking risk remains after normal checks.
Security architecture risk: 
3ea48
-
The change adds a fail-closed prerequisite before package publication without expanding publishing authority. A retained low-severity concern remains about whether the checked package manager is exactly the one used downstream. The command bindings and credential exposure predate this PR; no increased exposure was demonstrated. Effective certificate trust and release-run behavior remain partially unverified.
Retained concerns
No architecture-level concerns identified.Security review details
-
Security Blast Radius
- inferred — Compromise of code executing during the credential-bearing publishing steps could affect public or private package publication within the supplied credentials’ permissions. The workflow also has repository contents-write authority. Exact credential scopes and downstream consumer exposure are not established, and this PR does not visibly expand that authority.
Security Findings and Attack Paths
- observed — The supplied security assessment retains a low-severity finding about whether the gated pip identity matches downstream publishing commands, with reachability unknown. Separate command bindings and credential-bearing installations are present in the base as well as the head; no concrete attacker-controlled substitution or PR-expanded exposure was established.
- inferred — A malicious dependency or build backend executing in the publish step would run while public credentials are available; private publication occurs after private credentials are written to the runner. This is a pre-existing supply-chain exposure, not a newly demonstrated attack path. The deferred cache and certificate-trust candidates remain unresolved rather than verified vulnerabilities.
Trust Boundaries and Controls
- inferred — Setup-python’s documented PATH selection and the absence of a visible UV override support the normal downstream commands using the selected Python installation. However, the version check alone does not prove executable identity, isolated-build installer identity, or the effective CA set used by pip and Twine.
Resilience and Maintainability Implications
- observed — The private-index script appends credentials to ~/.pypirc without an explicit cleanup or transactional recovery path. Together with sequential uploads, this leaves interruption and repetition dependent on existing runner and repository behavior; these lifecycle properties were not changed by the PR.
-
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly identifies the primary change: updating the publish workflow to use a pip version that avoids the compromised eMudhra/emSign CA trust issue. Description check The description is complete and relevant. It explains the security issue, implementation changes, user impact, and test plan. It also includes the required checklist and clearly states that end-to-end… Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description is complete and relevant. It explains the security issue, implementation changes, user impact, and test plan. It also includes the required checklist and clearly states that end-to-end testing remains pending.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
@coderabbitai review |
✅ Action performed
|
Description
Hardens the release
publishjob in response to the eMudhra / emSign CA certificate incident (see the PSF's "Information for Python users regarding eMudhra / emSign CA certificate security incident" post on discuss.python.org). The compromised root was removed incertifi2026.10.19 and pip 26.2.2. pip vendors its own CA bundle, so the pip that ships with an older Python keeps trusting the root until pip itself is upgraded.The
publishjob ran on Python 3.10, whose bundled pip predates the fix. That pip installsbuildandtwine, themake package/make publishinstalls (pip3, sinceUVisn't set), andpython -m build's isolated setuptools environment. All of this runs in a job that holds the PyPI and private-index credentials.Changes:
python-version: '3.10'→'3.13'. 3.13.17 is available insetup-python's version list and bundles pip 26.2.2+. Changing the interpreter avoids upgrading pip through the vulnerable pip.User impact: none. The interpreter only runs
build/twine. The package is pure Python andrequires-pythonstays>=3.9.Test Plan
pyproject-build): it produces the sdist andsqlmesh-…-py3-none-any.whlwithRequires-Python: >=3.9.RECORD), same version.Checklist
make styleand fixed any issues (workflow YAML only)make fast-test) (no Python changes)git commit -s) per the DCOFollow-up worth considering separately: switch publishing to PyPI Trusted Publishing so the job holds no long-lived PyPI password.
Summary by CodeRabbit