Home | Notifications | New Note | Local | Federated | Search | Logout
Jesus Michał von Gentoo 🏔 (he)@mgorny@social.treehouse.systems
A #cat (owned by 3 cats), a nonconformist. #Gentoo developer, est. 2010. Taking care of #Python, #LLVM, #Xfce. #FreeSoftware enthusiast. #CarFree → #rail around #Poznań and western #Poland. #MADAO. #AntiCapitalism. #ActuallyAutistic + #diabetes. Random rants, silly humor. Playing with tongue, and enjoying double entendres.
Follows require approval because apparently AI-bros think not refusing a follow is consent.
Note: if you can read Polish, I recommend following my Polish profile instead (link in table). It includes unique content that doesn't work in English, and I boost all English content there anyway.
#TootFinder
Homepage: https://mgorny.pl/
GitHub: https://github.com/mgorny/
Donations: https://mgorny.pl/#donate
Polish profile: https://pol.social/@mgorny
Previous toots: https://fosstodon.org/@mgorny
Joined: 2026-08-29 03:05:27
2 notes, 0 following, 0 followers
Jesus Michał von Gentoo 🏔 (he)@mgorny@social.treehouse.systems (2026-10-21 11:28:56)
It's kinda funny that the certificate compromise comes just after another round of upstreams bashing at distro packaging.
Let me get this straight for the people in the back. In a perfect world, you'd just upgrade a single package on your system and be good. Unfortunately, we're far removed from even a reasonably good world.
Pretty much everything that matters in #Python uses certifi. dev-python/certifi in #Gentoo is a fork that uses system certs, so our system install is good. But in every virtual environment (venv, conda, etc.), you need to upgrade certifi.
certifi is also bundled in a bunch of packages, including pip. dev-python/pip in Gentoo has certifi unbundled, but you need to upgrade pip in your virtual environments (using vulnerable pip!). On Gentoo systems, you also need to upgrade dev-python/ensurepip-pip, which is the upstream wheel which we couldn't figure out how to unbundle.
pip is also bundled in Python to bootstrap venvs. In Gentoo, we're configuring Python to use our system dev-python/ensurepip-pip package, so as soon as you upgrade it, you're good. But where this isn't the case, you need to wait for new Python releases and upgrade, because otherwise venvs will start with vulnerable pip. On the plus side, you can remember to upgrade it after creating a new venv.
Lock files are particularly popular in the Python world, and a dependency cooldown is the new fad. You will need to update certifi in them, and exclude it from dependency cooldown.
Many #RustLang packages (think uv) also use a bundled certificate store. All these packages need a lockfile update and rebuilding, meaning downstream patching or new upstream release. So yes, everyone (including Gentoo users, because Rust doesn't really support dynamic linking, great design for #security) need to update uv, and possibly wait to discover more random Rust packages that are vulnerable.
I'm also going to guess that all flatpakers are affected, all popular browsers, and possibly everyone else w
Reply to @dthompson@toot.cat
Jesus Michał von Gentoo 🏔 (he)@mgorny@social.treehouse.systems (2026-08-29 02:58:32)
@dthompson, let's not forget that most of them self-publishing packaging systems are ripe for supply chain attacks. It's literally pushing the burden onto end users.