emSign root CA revocation: pypi-publish GitHub Action — bundled compromised CA in certifi breaks Sigstore trust for Trusted Publishing (GHSA-5xjx-3w67-w9x9)
Severity: critical · Patch status: patched · Since 2026-10-30
The pypi-publish GitHub Action versions up to 1.14.2 bundled the emSign root CA certificate via the certifi distribution, which Sigstore relies on for Trusted Publishing and Digital Attestations to PyPI. Following an external compromise of the emSign CA (tracked at emudhra.we-have-a-problem.com), the compromised root CA was revoked and removed from the trust bundle. Action versions <= 1.14.2 still carry the revoked CA, undermining the trust chain used to attest PyPI package uploads. Version 1.14.3 removes the certificate and restores a clean trust chain. The advisory is rated critical (CVSS 9.3) with network attack vector and high confidentiality/integrity impact. Projects using pypi-publish for Trusted Publishing should upgrade to 1.14.3; no in-the-wild exploitation via the action is confirmed.
What to do
- Upgrade pypi-publish to 1.14.3 or later in all release workflows immediately
- Re-run or re-verify recent PyPI publishes and check attestation/Sigstore signatures for validity
- Audit CI pipelines for other uses of certifi bundles containing the emSign root CA and remove/refresh trust stores
- Monitor PyPI and Sigstore advisories for further guidance on affected attestations
Fixed versions
Sources
All live incidents on Threat Watch
