GeezerVison

…keys (CVE-2026-115557) (pythonGH-160042) (pythonGH-160572)

The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

(cherry picked from commit 7dd8b47)

Co-authored-by: Christian Heimes <[email protected]>
Co-authored-by: Łukasz Langa <[email protected]>
(cherry picked from commit af52b41)

3.10.22.x: 3.10 keeps the test certificates directly in Lib/test (no
certdata/ subdirectory) and builds _ssl from setup.py, so distrusted.zip
lands in Lib/test and distrusted_spki.h is added to the _ssl depends in
setup.py instead of MODULE__SSL_DEPS.

…keys (CVE-2026-115557) (pythonGH-160042) (pythonGH-160572)

The ssl module now rejects TLS certificate chains that contain any of a set of
compromised eMudhra intermediate CA keys.  This is an extraordinary measure and
a last line of defense: removing trust is primarily the job of the platform root
store, and the built-in denylist only blocks connections while that update has
not yet reached the OS, a container image, or a bundled trust store in various
Python packages.  Entries are added to the denylist only under a very high
threshold.

The denylist matches on the public key (the SHA-256 digest of the RFC-5280
SubjectPublicKeyInfo), so it also covers the cross-signed certificates that
reuse one of the distrusted keys.

(cherry picked from commit 7dd8b47)

Co-authored-by: Christian Heimes <[email protected]>
Co-authored-by: Łukasz Langa <[email protected]>
(cherry picked from commit af52b41)

3.10.22.x: 3.10 keeps the test certificates directly in Lib/test (no
certdata/ subdirectory) and builds _ssl from setup.py, so distrusted.zip
lands in Lib/test and distrusted_spki.h is added to the _ssl depends in
setup.py instead of MODULE__SSL_DEPS.

(cherry picked from commit 2691076)

* python: backport emudhra ssl distrust for 3.10

CVE-2026-115557: backport Modules/_ssl distrusted SPKI denylist from CPython 3.11 merge python/cpython#160572 onto the 3.10.22 line (REL 3).

CVE-2026-3298: carry-forward existing not_affected VEX to python-3.10 -r2/-r3 apk PURLs (sock_recvfrom_into absent in 3.10).

Hook-Bypass: package-build-tags-bump: pre-commit merge refreshes sibling python .build outputs without publish identity changes; only 3.10 REL moves in this commit.

* python: register ssl patch and fix provenance headers

Hook-Bypass: dhi-def-merge: shared .python.inc.yaml merge refreshes sibling .build without publish bumps
Hook-Bypass: package-build-tags-bump: same shared-include merge side effect; only 3.10 r3 identity changes

* python: scope git/patch pipeline to 3.10 leaves only

* vex: roll forward python 3.14.10 purls

Python 3.14.10 includes the upstream sock_recvfrom_into buffer-boundary fix. Extend the existing not_affected statement to the current Alpine package revisions.

* python: use version patch loop

The dedicated 3.10 includes made the package identity hook treat unchanged sibling leaves as modified. The existing version-scoped patch loop applies the SSL backport only to Python 3.10.

* python: scope CVE-2026-115557 patch to 3.10

Move the emudhra distrust backport out of the recursively staged shared patch tree and mount it only in Python 3.10 builds. This keeps unchanged Python package leaves from requiring unrelated release bumps.

* vex: cover python 3.10 r4

* python: answer 3.10 review comments

The copied 3.10 pipelines no longer put authoring notes in runs blocks. Existing VEX statements that still apply now list the 3.10.22-r4 packages, and the tree records why the 3.10 pipeline is copied. Three patch-record notes no longer name one package revision, so the product append is not a pure carry-forward.

* vex: limit python 3.10 emudhra statement to r4

The CVE-2026-115557 statement listed the unpatched 3.10.22-r3 packages and the shared python 3.10.22 product. It now lists only the rebuilt r4 APKs. The three rewritten patch notes cite the public CPython commits instead of definitions patch paths.

---------

Co-authored-by: dhi-bot <[email protected]>

[dhi-commit=6297970ec15b10a925bb75e69fc27f72bddc896e]