From 8054794c7615f4d84340a4739c481193a7e04ae2 Mon Sep 17 00:00:00 2001
From: Kirill Markin <markinkirill@gmail.com>
Date: Fri, 23 Oct 2026 08:44:08 +0200
Subject: [PATCH] Remove compromised emSign trust from development and pip
 tooling

Require certifi 2026.10.19 for development dependencies and bootstrap pip 26.2.2 from its hash-verified official wheel in CI and Docker.

Co-authored-by: Codex <codex@openai.com>
---
 .github/workflows/python-publish.yml |  2 +-
 .github/workflows/tests.yml          |  2 +-
 Dockerfile                           | 13 +++----------
 poetry.lock                          | 10 +++++-----
 pyproject.toml                       |  1 +
 5 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index c322162..135d6bb 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -22,7 +22,7 @@ jobs:
         python-version: '3.14'
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip
+        python -m pip install --upgrade "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
         pip install build
     - name: Build package
       run: python -m build
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8cfee1f..84627f7 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -26,7 +26,7 @@ jobs:
       run: sudo apt-get install -y tree
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip
+        python -m pip install --upgrade "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
         pip install .[dev]
     - name: Run pylint
       run: |
diff --git a/Dockerfile b/Dockerfile
index 253dc95..07f0aa3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,33 +1,26 @@
 FROM python:3.14.7-slim
 
-# Set environment variables
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     PIP_NO_CACHE_DIR=1
 
-# Create non-root user
 RUN useradd -m -s /bin/bash user
 
-# Install system dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    tree \
+    ca-certificates tree \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
-# Copy all necessary files for package installation
 COPY pyproject.toml README.md ./
 
-# Copy the package source
 COPY repo_to_text ./repo_to_text
 
-# Install the package
-RUN pip install --no-cache-dir -e .
+RUN python -m pip install --no-cache-dir --upgrade "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" \
+    && python -m pip install --no-cache-dir -e .
 
-# Copy remaining files
 COPY . .
 
-# Set default user
 USER user
 
 ENTRYPOINT ["repo-to-text"]
diff --git a/poetry.lock b/poetry.lock
index c6443ab..9b28665 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -194,15 +194,15 @@ virtualenv = ["virtualenv (>=20.17) ; python_version >= \"3.10\" and python_vers
 
 [[package]]
 name = "certifi"
-version = "2026.7.22"
+version = "2026.10.19"
 description = "Python package for providing Mozilla's CA Bundle."
 optional = true
 python-versions = ">=3.7"
 groups = ["main"]
 markers = "extra == \"dev\""
 files = [
-    {file = "certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775"},
-    {file = "certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55"},
+    {file = "certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b"},
+    {file = "certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae"},
 ]
 
 [[package]]
@@ -1705,9 +1705,9 @@ test = ["big-O", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more_it
 type = ["pytest-mypy (>=1.0.1) ; platform_python_implementation != \"PyPy\""]
 
 [extras]
-dev = ["black", "build", "isort", "mypy", "pylint", "pytest", "twine"]
+dev = ["black", "build", "certifi", "isort", "mypy", "pylint", "pytest", "twine"]
 
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10"
-content-hash = "b9b3863b13e04ad82f988c1fb26ceff9684347e6d34e7e4e58889275ac06862b"
+content-hash = "76d7e2feea383eec487b0d5124ffca7fc5fd80d8c38b73f9b631bdd97cd501bc"
diff --git a/pyproject.toml b/pyproject.toml
index 829027f..72c7b9b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,6 +41,7 @@ dev = [
     "isort",
     "build",
     "twine",
+    "certifi>=2026.10.19",
     "pylint",
 ]