Emudhra ca remediation

.github/actions/generate-changelog/action.yml

@@ -25,10 +25,7 @@ runs:
   using: composite
   steps:
     - name: Install uv
-      uses: astral-sh/setup-uv@v6
-      with:
-        version: "0.8.x"
-        enable-cache: true
+      uses: ./.github/actions/setup-uv
     - name: Generate changelog
       shell: bash
       run: |

.github/actions/setup-uv/action.yml

@@ -0,0 +1,14 @@
+name: Set up uv
+description: Install the pinned uv release after verifying its checksum
+
+runs:
+  using: composite
+  steps:
+    - name: Install uv
+      uses: astral-sh/setup-uv@v6
+      with:
+        version: "0.13.4"
+        # setup-uv@v6 skips verification for releases missing from its built-in checksum list, 0.13.4 included.
+        # The checksum is of uv-x86_64-unknown-linux-gnu.tar.gz, so the action works on x86_64 Linux runners only.
+        checksum: "2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f"
+        enable-cache: true

.github/workflows/commit_linting.yaml

@@ -26,10 +26,7 @@ jobs:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
 
       - name: Install dependencies
         run: uv tool install gitlint-core

.github/workflows/compute_horde_sdk_cd_docs.yml

@@ -40,10 +40,7 @@ jobs:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
 
       - name: Install dependencies
         run: uv tool install nox

.github/workflows/compute_horde_sdk_ci.yml

@@ -21,10 +21,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Run linters
@@ -41,10 +38,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Run linters
@@ -67,10 +61,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Run unit tests

.github/workflows/compute_horde_sdk_publish.yml

@@ -59,10 +59,7 @@ jobs:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
 
       - name: Build
         run: uv build

.github/workflows/executor_ci.yml

@@ -21,10 +21,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Create dotenv file
@@ -43,10 +40,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Create dotenv file
@@ -66,10 +60,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Prepare environment

.github/workflows/facilitator_ci.yml

@@ -21,10 +21,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Run linters
@@ -42,10 +39,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Prepare environment

.github/workflows/integration_ci.yml

@@ -22,10 +22,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Start all services
         run: local_stack/run_and_await_readiness.sh /tmp/integration_test_logs/
 

.github/workflows/integration_ci_fallback.yml

@@ -27,10 +27,7 @@ jobs:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
 
       - name: Setup SSH key
         run: |

.github/workflows/library_cd.yml

@@ -26,6 +26,9 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
+      # pip < 26.2.2 vendors a certifi that trusts the compromised eMudhra CAs; the hash pin protects this download.
+      - name: Upgrade pip
+        run: python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
       - name: Install dependencies
         run: python -m pip install --upgrade nox 'pdm==2.19.3'
       - name: Get version from tag

.github/workflows/library_ci.yml

@@ -21,10 +21,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Run linters
@@ -43,10 +40,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Run mypy
@@ -64,10 +58,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Run unit tests

.github/workflows/miner_ci.yml

@@ -21,10 +21,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Create dotenv file
@@ -43,10 +40,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Create dotenv file
@@ -66,10 +60,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Prepare environment

.github/workflows/validator_ci.yml

@@ -21,10 +21,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Create dotenv file
@@ -43,10 +40,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Create dotenv file
@@ -100,10 +94,7 @@ jobs:
         with:
           python-version: ${{ env.PYTHON_DEFAULT_VERSION }}
       - name: Install uv
-        uses: astral-sh/setup-uv@v6
-        with:
-          version: "0.8.x"
-          enable-cache: true
+        uses: ./.github/actions/setup-uv
       - name: Install dependencies
         run: uv tool install nox
       - name: Prepare environment

compute_horde/changelog.d/+certifi-emudhra.fixed.md

@@ -0,0 +1 @@
+The library requires `certifi>=2026.10.19`, because earlier certifi releases trust the compromised eMudhra/emSign CAs.

compute_horde/pyproject.toml

@@ -11,6 +11,7 @@ dependencies = [
     "websockets>=14.0,<15.0",
     "more-itertools>=10.2.0",
     "requests>=2.32.2",
+    "certifi>=2026.10.19",  # earlier releases trust the compromised eMudhra/emSign CAs
     "Django~=4.2.4",
     "cryptography>=42.0.8",
     "celery<6,>=5.3.0",

compute_horde_sdk/changelog.d/+certifi-emudhra.fixed.md

@@ -0,0 +1 @@
+The SDK requires `certifi>=2026.10.19`, because earlier certifi releases trust the compromised eMudhra/emSign CAs.

compute_horde_sdk/pyproject.toml

@@ -21,6 +21,7 @@ dependencies = [
     "asgiref>=3.8.0,<4",
     "pydantic<3,>=2.3",
     "httpx>=0.26.0",
+    "certifi>=2026.10.19",  # earlier releases trust the compromised eMudhra/emSign CAs
     "cryptography>=42.0.8",
     "aiohttp>=3.12.0",
     "bittensor-wallet~=4.0",