Cyber ·
Mailing-list comment on system certificate stores and the eMudhra/emSign CA incident
A comment dated 22 October 2026 on the oss-sec list describes how Linux distributions and pip can use the system certificate store instead of bundled certificates, in the context of the eMudhra/emSign CA incident.
A comment published on 22 October 2026 on the oss-sec mailing list, a list for open source software security, and reproduced in a feed on 23 October, addresses the security incident involving the certificate authority (CA) certificate from eMudhra/emSign. The text states that Linux distribution packages may use the system certificate store instead of certificates bundled with the application. According to the message, certifi packages supplied by distributions are usually patched or built to use the system store, and pip is decoupled to use the system certifi, through the system requests library.
The comment also mentions that a sigstore update was updating one of the affected components. The available excerpt does not detail the full scope of the incident, revocation dates or fixed versions. For that reason, this record should not be used as a list of technical actions.
To verify, consult the original message in the public 2026 oss-sec archive, fourth-quarter edition, locating the thread by its title. Compare it with the official advisories from your distribution and the Python project before changing any certificate configuration.