[tianon]

Upstream is not updating the pip bundled with 3.11 and 3.12, and its vendored "certifi" bundle still trusts a compromised CA. Apply Debian's "certifi-debian-ca-certificates" patch (downloaded via a raw URL pinned to a Debian commit and verified by checksum, with the Debian branding adjusted on Alpine) to both the installed pip and the bundled "ensurepip" wheel so new venvs are covered too. Keyed on the exact versions so any upstream update drops it automatically.

Refs:

• These images ship vulnerable pip #1142

[yosifkit]

As seen in the discussion (https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576/19), these old pip versions are subject to other vulnerabilities and it is recommended to use the latest pip. We recommend that you upgrade to the latest (like pip install --upgrade pip) and this patch will allow you to now do that in the 3.11 and 3.12 Debian and Alpine images without worrying about the compromised CA certs. If you can't use a newer pip because of backwards incompatibilities, you should definitely look at any other possible vulnerabilities in those pip versions and see how you can protect your builds.

[edmorley]

I think python/cpython#160040 if backported to 3.11 and 3.12, will protect older pip against the older certifi bundled within it, making this PR no longer needed?

[edmorley]

Yeah this is now redundant after:
https://blog.python.org/2026/10/python-3152-31410-31318-31216-31118/

[tianon]

Fair enough 👍

[tianon]

(it's probably worth considering whether we should apply this patch all the time across all versions in the future, but that's not as obvious a call as this was 👍)

[edmorley]

Yeah agree it would be good for pip to depend on the system ca-certificates package in these images in general rather than the vendored certifi. Longer term hopefully pypa/pip#14374 (or a variation on it) might make things easier for distributors here.