Skip to content

fix(nix): build CPython 3.14.10 for the ssl eMudhra denylist - #20

Merged
furedea merged 1 commit into
mainfrom
fix/python-3-14-10
Nov 9, 2026
Merged

fix(nix): build CPython 3.14.10 for the ssl eMudhra denylist#20
furedea merged 1 commit into
mainfrom
fix/python-3-14-10

Conversation

@furedea-agent

@furedea-agent furedea-agent Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

概要

自前ビルドの CPython を 3.14.9 から 3.14.10 に更新します．3.14.10 は，侵害された eMudhra 中間証明書を ssl モジュールの denylist に加えた最初のリリースです（3.14.9 は同梱 pip / certifi の更新のみ）．

変更

  • nix/python.nix: 3.14.10 に更新し，tarball の SRI hash を差し替え，TODO コメントを書き換え
  • pyproject.toml: requires-python = ">= 3.14.10, < 3.15"
  • uv.lock: requires-python を追従

判断

  • nixpkgs は 3.14.8 のため，nixpkgs が 3.14.10 以上を出すまで自前ビルドを維持します．
  • mimetypes の postPatch は引き続き必要なため残しています．
  • nix/uv.nix（uv 0.13.5）は変更しません．dev shell は Nix の Python を使い，UV_PYTHON_DOWNLOADS=never のため影響がありません．

検証

  • nix flake check: 通過
  • nix develop -c python --version: Python 3.14.10
  • uv run pytest --cov: 通過

🤖 Generated with Claude Code

@furedea @claude
fix(nix): build CPython 3.14.10 for the ssl eMudhra denylist
3f4de68 
3.14.10 is the first release whose ssl module denylists the compromised
eMudhra intermediates. Raise requires-python to match.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@furedea

furedea commented Nov 9, 2026

Copy link
Copy Markdown
Owner

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 9, 2026

Copy link
Copy Markdown
Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ❌ Failed 2026-11-09T14:41:52.487074Z
We couldn’t complete this review. Comment @codex review to try again.		 3f4de68 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 9, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown

Review summary

No findings.

I checked the version bump to 3.14.10 in nix/python.nix, pyproject.toml and uv.lock. The three files agree, and .python-version (3.14) still matches. The dev shell and CI both use the Nix-built interpreter (UV_PYTHON_DOWNLOADS=never, UV_PYTHON_PREFERENCE=only-system), so leaving nix/uv.nix at 0.13.5 does not affect them. The mimetypes postPatch is unchanged.

I could not download the tarball in this environment, so I did not check the new SRI hash myself. The nix-check CI job builds the derivation and will fail if the hash is wrong.

Blocking findings (P0/P1): 0

@furedea
furedea merged commit 5e24c05 into main Nov 9, 2026
16 of 18 checks passed
@furedea
furedea deleted the fix/python-3-14-10 branch November 9, 2026 14:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@furedea furedea furedea approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@furedea