Remove compromised emSign trust from development and pip tooling

Require certifi 2026.10.19 for development dependencies and bootstrap pip 26.2.2 from its hash-verified official wheel in CI and Docker.

Co-authored-by: Codex <codex@openai.com>

.github/workflows/python-publish.yml

@@ -22,7 +22,7 @@ jobs:
         python-version: '3.14'
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip
+        python -m pip install --upgrade "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
         pip install build
     - name: Build package
       run: python -m build

.github/workflows/tests.yml

@@ -26,7 +26,7 @@ jobs:
       run: sudo apt-get install -y tree
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip
+        python -m pip install --upgrade "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
         pip install .[dev]
     - name: Run pylint
       run: |

Dockerfile

@@ -1,33 +1,26 @@
 FROM python:3.14.7-slim
 
-# Set environment variables
 ENV PYTHONUNBUFFERED=1 \
     PYTHONDONTWRITEBYTECODE=1 \
     PIP_NO_CACHE_DIR=1
 
-# Create non-root user
 RUN useradd -m -s /bin/bash user
 
-# Install system dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    tree \
+    ca-certificates tree \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
-# Copy all necessary files for package installation
 COPY pyproject.toml README.md ./
 
-# Copy the package source
 COPY repo_to_text ./repo_to_text
 
-# Install the package
+RUN python -m pip install --no-cache-dir --upgrade "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" \
-RUN pip install --no-cache-dir -e .
+    && python -m pip install --no-cache-dir -e .
 
-# Copy remaining files
 COPY . .
 
-# Set default user
 USER user
 
 ENTRYPOINT ["repo-to-text"]

poetry.lock

@@ -194,15 +194,15 @@ virtualenv = ["virtualenv (>=20.17) ; python_version >= \"3.10\" and python_vers
 
 [[package]]
 name = "certifi"
-version = "2026.7.22"
+version = "2026.10.19"
 description = "Python package for providing Mozilla's CA Bundle."
 optional = true
 python-versions = ">=3.7"
 groups = ["main"]
 markers = "extra == \"dev\""
 files = [
-    {file = "certifi-2026.7.22-py3-none-any.whl", hash = "sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775"},
+    {file = "certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b"},
-    {file = "certifi-2026.7.22.tar.gz", hash = "sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55"},
+    {file = "certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae"},
 ]
 
 [[package]]
@@ -1705,9 +1705,9 @@ test = ["big-O", "jaraco.functools", "jaraco.itertools", "jaraco.test", "more_it
 type = ["pytest-mypy (>=1.0.1) ; platform_python_implementation != \"PyPy\""]
 
 [extras]
-dev = ["black", "build", "isort", "mypy", "pylint", "pytest", "twine"]
+dev = ["black", "build", "certifi", "isort", "mypy", "pylint", "pytest", "twine"]
 
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10"
-content-hash = "b9b3863b13e04ad82f988c1fb26ceff9684347e6d34e7e4e58889275ac06862b"
+content-hash = "76d7e2feea383eec487b0d5124ffca7fc5fd80d8c38b73f9b631bdd97cd501bc"

pyproject.toml

@@ -41,6 +41,7 @@ dev = [
     "isort",
     "build",
     "twine",
+    "certifi>=2026.10.19",
     "pylint",
 ]