You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 045a9e1
Browse filesBrowse the repository at this point in the historyBrowse files
CI: fail setup-hardened-python for Python series without a known fix
Python 3.16.0a1 was tagged before the CPython fix for CVE-2026-115557
merged, so warning on series newer than the fixed-release table let a
known-vulnerable interpreter through. Treat any unlisted series as an
error; a new series is accepted once its fixed release is added.
Copy file name to clipboardExpand all lines: .github/actions/setup-hardened-python/action.yml
+5-6Lines changed: 5 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -19,9 +19,9 @@ description: >-
19
19
inputs:
20
20
python-version:
21
21
description: >-
22
-
uv Python request, e.g. "3.12", "3.14t" (free-threaded), or "3.16"
23
-
(resolves to a prerelease while no final release exists). The newest
24
-
patch known to the pinned uv is installed.
22
+
uv Python request, e.g. "3.12" or "3.14t" (free-threaded). The newest
23
+
patch known to the pinned uv is installed. Only series with a fixed
24
+
release listed in the interpreter check (3.11-3.15) are accepted.
25
25
required: true
26
26
venv:
27
27
description: Directory for the venv. Defaults to a new directory under RUNNER_TEMP.
@@ -112,10 +112,9 @@ runs:
112
112
print(f"::error::Python {full} is older than {floor}, the first {name} release whose ssl module rejects the compromised eMudhra CA keys (CVE-2026-115557).")
113
113
sys.exit(1)
114
114
print(f"Python {full}: ssl module carries the fix (first fixed: {floor}).")
115
-
elif series > max(FIXED):
116
-
print(f"::warning::Python {full}: no fixed {name} release is known yet.")
117
115
else:
118
-
print(f"::error::Python {name} has no release whose ssl module rejects the compromised eMudhra CA keys (CVE-2026-115557).")
116
+
# Fail closed: a series is only accepted once its fixed release is listed.
117
+
print(f"::error::Python {full}: no {name} release is known to reject the compromised eMudhra CA keys (CVE-2026-115557).")
0 commit comments