Require b2sdk 2.13.2, certifi 2026.10.19, pip 26.2.2, and uv 0.13.4 o…

.github/workflows/cd.yml

@@ -8,7 +8,7 @@ env:
   CD: "true"
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   PYTHON_DEFAULT_VERSION: "3.12"
-  UV_VERSION: "0.8.24"
+  UV_VERSION: "0.13.4"
 
 jobs:
   deploy:
@@ -204,6 +204,8 @@ jobs:
         uses: docker/build-push-action@v3
         with:
           context: .
+          pull: true
+          no-cache: true
           push: true
           tags: ${{ steps.docker_tags_prep.outputs.docker_tags }}
           platforms: linux/amd64,linux/arm64

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ on:
 
 env:
   PYTHON_DEFAULT_VERSION: "3.12"
-  UV_VERSION: "0.8.24"
+  UV_VERSION: "0.13.4"
 
 jobs:
   lint:
@@ -185,6 +185,8 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: .
+          pull: true
+          no-cache: true
           load: true
           tags: backblazeit/b2:test
           platforms: linux/amd64

.readthedocs.yml

@@ -8,6 +8,12 @@ build:
   os: ubuntu-24.04
   tools:
     python: "3.14"
+  apt_packages:
+    - ca-certificates
+  jobs:
+    pre_create_environment:
+      - python -m pip install --upgrade 'pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70'
+      - python -m pip install --upgrade 'uv==0.13.4'
 
 sphinx:
   configuration: doc/source/conf.py

changelog.d/+emsign-certificates.fixed.md

@@ -0,0 +1 @@
+Require b2sdk 2.13.2, certifi 2026.10.19, pip 26.2.2, and uv 0.13.4 or newer to address the eMudhra / emSign CA certificate incident. Update CI and container builds to use the patched tools and refresh container system certificates.

docker/Dockerfile.template

@@ -1,6 +1,18 @@
-FROM python:${python_version}-slim as builder
+FROM python:${python_version}-slim AS base
 
-RUN apt-get update -y && apt-get install git patchelf -y && pip install -U uv==0.8.24
+RUN apt-get update -y \
+    && apt-get install --no-install-recommends -y ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+# Bootstrap pip with the checksum published in the Python security advisory.
+RUN python -m pip install --no-cache-dir --upgrade \
+    'pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70'
+
+FROM base AS builder
+
+RUN apt-get update -y \
+    && apt-get install --no-install-recommends -y git patchelf \
+    && rm -rf /var/lib/apt/lists/* \
+    && python -m pip install --no-cache-dir uv==0.13.4
 
 WORKDIR /b2
 COPY ./b2 /b2/b2
@@ -13,7 +25,7 @@ RUN rm -r .venv && mkdir __pypackages__
 RUN uv export --locked --no-dev --extra full --no-hashes --no-editable -o requirements.txt
 RUN uv pip install --compile-bytecode --python /usr/local/bin/python --prefix __pypackages__ -r requirements.txt
 
-FROM python:${python_version}-slim
+FROM base
 
 LABEL vendor=${vendor}
 LABEL name="${name}"

noxfile.py

@@ -675,7 +675,7 @@ def build_and_test_docker(session):
     """
     test_image_tag = 'b2:test'
     generate_dockerfile(session)
-    session.run('docker', 'build', '-t', test_image_tag, '.', external=True)
+    session.run('docker', 'build', '--pull', '--no-cache', '-t', test_image_tag, '.', external=True)
     run_docker_tests(session, test_image_tag)
 
 

pyproject.toml

@@ -24,7 +24,8 @@ classifiers = [
 dependencies = [
     "argcomplete>=3.5.2,<4",
     "arrow>=1.0.2,<2.0.0",
-    "b2sdk>=2.13.0,<3",
+    "b2sdk>=2.13.2,<3",
+    "certifi>=2026.10.19",
     "docutils>=0.18.1,<0.22",
     "idna~=3.4; platform_system == 'Java'",
     "rst2ansi==0.1.5",
@@ -38,7 +39,7 @@ full = [
     "pydantic>=2.0.1,<3"
 ]
 license = [
-    "pip>=26.1",
+    "pip>=26.2.2",
     "pip-licenses~=5.0",
     "pipdeptree>=2.9,<3",
     "prettytable~=3.9",
@@ -47,6 +48,7 @@ license = [
 [dependency-groups]
 nox = [
     "nox>=2025.11.12",
+    "pip>=26.2.2",
 ]
 doc = [
     "sadisplay>=0.4.9",
@@ -60,6 +62,7 @@ format = [
     "ruff~=0.8.4",
 ]
 lint = [
+    "pip>=26.2.2",
     "ruff~=0.8.4",
     "pytest>=9.0.3,<10",
     "tenacity>=9.1.4,<10",
@@ -70,6 +73,7 @@ release = [
     "towncrier==23.11.0",
 ]
 test = [
+    "pip>=26.2.2",
     "coverage>=7.13.5,<8",
     "pexpect>=4.9.0,<5",
     "pytest>=9.0.3,<10",
@@ -89,6 +93,7 @@ bundle = [
 ]
 
 [tool.uv]
+required-version = ">=0.13.4"
 no-build-isolation-package = ["patchelf-wrapper", "staticx"]
 
 [project.urls]