From 56d64fb1fe9f4e3944e425cea0d71b9607d27392 Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:31:13 +0200
Subject: [PATCH 1/8] security: repin CA-safe uv and Python standalone builds
 (#284)

---
 images/base/Dockerfile                        | 11 +++++--
 mise.lock                                     | 32 +++++++++----------
 mise.toml                                     |  2 +-
 .../python-build-standalone-315/manifest.json | 24 +++++++-------
 .../python-build-standalone/manifest.json     | 24 +++++++-------
 third_party/inventory.json                    |  8 ++---
 .../standalone-artifact-inspection.json       | 14 ++++----
 third_party/standalone-artifact-inspection.md |  2 +-
 versions.env                                  |  2 +-
 9 files changed, 63 insertions(+), 56 deletions(-)

diff --git a/images/base/Dockerfile b/images/base/Dockerfile
index 6367362..8faae44 100644
--- a/images/base/Dockerfile
+++ b/images/base/Dockerfile
@@ -21,7 +21,7 @@ ARG PYTHON_VERSION=3.14.8
 ARG PYTHON_315_VERSION=3.15.0
 ARG NODE_VERSION=24.22.0
 ARG NPM_VERSION=12.2.1
-ARG UV_VERSION=0.13.1
+ARG UV_VERSION=0.13.4
 
 LABEL org.opencontainers.image.title="Remote Dev Base" \
       org.opencontainers.image.description="Community remote development base for browser-hosted coding agents" \
@@ -212,7 +212,14 @@ RUN test "$(stat -c '%a' "$MISE_SYSTEM_CONFIG_DIR")" = 755 \
     && test "$(npm --version)" = "$NPM_VERSION" \
     && test "$(npx --version)" = "$NPM_VERSION" \
     && uv --version \
-    && rm -rf "${MISE_CACHE_DIR:?}"/*
+    && test "$(uv --version | awk '{print $2}')" = "${UV_VERSION}" \
+    && for security_python in \
+      "$MISE_DATA_DIR/installs/python/$PYTHON_VERSION/bin/python3" \
+      "$MISE_DATA_DIR/installs/python/$PYTHON_315_VERSION/bin/python3"; do \
+        "$security_python" -I -c 'import pip; v=tuple(map(int,pip.__version__.split(".")[:3])); assert v >= (26,2,2), f"insecure pip {pip.__version__}"' || exit; \
+        "$security_python" -I -m pip --version || exit; \
+      done \
+    && rm -rf "${MISE_CACHE_DIR:?"}"/*
 
 # Keep project and bundled-component terms inspectable in both the repository and
 # the built image. Runtime archives contribute their own license files here.
diff --git a/mise.lock b/mise.lock
index a139337..ebb67d4 100644
--- a/mise.lock
+++ b/mise.lock
@@ -65,13 +65,13 @@ backend = "core:python"
 specifiers = ["3.14.8"]
 
 [tools.python."platforms.linux-arm64"]
-checksum = "sha256:4395ae16388f9d3409cba7e20161753ed3359b13d959345415029f874f675162"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:6519109a1bed8cff79aad3a6df880c95dde153e2c4c9713846476fa344d94049"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [tools.python."platforms.linux-x64"]
-checksum = "sha256:b373a4a4e4e70fc05f368c9b53d7738bf37637682b650d96c742805d2da26c32"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:b88a4ac994ac55c35a03a3672103618d5c5d5bf342db7b2093b8d328b6516b42"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [[tools.python]]
@@ -80,13 +80,13 @@ backend = "core:python"
 specifiers = ["3.15.0"]
 
 [tools.python."platforms.linux-arm64"]
-checksum = "sha256:00345e47b7f42d10ec60d28b2ccad6b1f33c40697f0ae57ee15d70896efad0b5"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:341f9984c0206fef013761fa6adc5b26f28fcf333dd9bc9ff64f23b6fdf9b58b"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [tools.python."platforms.linux-x64"]
-checksum = "sha256:46edc8f6fccade47dc38001ef2d4094d9cedd21a1863d9b44b2a02c1ee76b94d"
-url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
+checksum = "sha256:d8982167b0b96b660a688f2b8f1e47e49d7c50da17029a07d3ac5fd418514c63"
+url = "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz"
 provenance = "github-attestations"
 
 [[tools.shfmt]]
@@ -105,20 +105,20 @@ url = "https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_linux
 url_api = "https://api.github.com/repos/mvdan/sh/releases/assets/547320883"
 
 [[tools.uv]]
-version = "0.13.1"
+version = "0.13.4"
 backend = "aqua:astral-sh/uv"
-specifiers = ["0.13.1"]
+specifiers = ["0.13.4"]
 
 [tools.uv."platforms.linux-arm64"]
-checksum = "sha256:9041c73c99fdc5892cf128140beb354eca9231d502068cc36e6cb53a8e59ad14"
-url = "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/639312990"
+checksum = "sha256:1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693320"
 provenance = "github-attestations"
 
 [tools.uv."platforms.linux-x64"]
-checksum = "sha256:eadd9d27c134ab5ac1ffd4473b97a741407f3ea238288f03121fc4deddf90220"
-url = "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/639313223"
+checksum = "sha256:2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f"
+url = "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/astral-sh/uv/releases/assets/659693663"
 provenance = "github-attestations"
 
 [[tools.yq]]
diff --git a/mise.toml b/mise.toml
index bfbcf7e..e09ad12 100644
--- a/mise.toml
+++ b/mise.toml
@@ -6,7 +6,7 @@ lockfile_platforms = ["linux-x64", "linux-arm64"]
 [tools]
 python = ["3.14.8", "3.15.0"]
 node = "24.22.0"
-uv = "0.13.1"
+uv = "0.13.4"
 "pypi:ruff" = { version = "0.17.1", python = "3.14.8" }
 "pypi:pytest" = { version = "9.1.1", python = "3.14.8" }
 "pypi:pre-commit" = { version = "4.7.0", python = "3.14.8" }
diff --git a/third_party/components/python-build-standalone-315/manifest.json b/third_party/components/python-build-standalone-315/manifest.json
index e392535..c7ddb50 100644
--- a/third_party/components/python-build-standalone-315/manifest.json
+++ b/third_party/components/python-build-standalone-315/manifest.json
@@ -25,23 +25,23 @@
       "arch": "amd64",
       "target": "x86_64-unknown-linux-gnu",
       "python_version": "3.15.0",
-      "release": "20261009",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.15.0+20261009-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0%2B20261009-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "61f112783818a61cebc0d6b9894614295fd38e7d885833cbc5d5c1d565a2a5a9",
-      "full_asset_size": 119795975
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.15.0+20261020-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0%2B20261020-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "e3ad05e5f5a00d4b9d74cddf81258a8e934b7f24e316c4fe4ec508432fe0982a",
+      "full_asset_size": 122797375
     },
     {
       "arch": "arm64",
       "target": "aarch64-unknown-linux-gnu",
       "python_version": "3.15.0",
-      "release": "20261009",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.15.0+20261009-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261009/cpython-3.15.0%2B20261009-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "449a4331f64967bf047e720eb3ef0a791796cc0a0f6785c000461fe0e6905220",
-      "full_asset_size": 104006693
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.15.0+20261020-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.15.0%2B20261020-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "2da40807fd62dd351355d2d0a82b6273ee1bede82744daae2d4044602b8b15ed",
+      "full_asset_size": 106109980
     }
   ]
 }
diff --git a/third_party/components/python-build-standalone/manifest.json b/third_party/components/python-build-standalone/manifest.json
index a7f4fbe..a4db112 100644
--- a/third_party/components/python-build-standalone/manifest.json
+++ b/third_party/components/python-build-standalone/manifest.json
@@ -25,23 +25,23 @@
       "arch": "amd64",
       "target": "x86_64-unknown-linux-gnu",
       "python_version": "3.14.8",
-      "release": "20261001",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.14.8+20261001-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8%2B20261001-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "0f5cfcf664aa406ee958625ed5b29b1bfc76d553e8ad1304f48fec39b74e0554",
-      "full_asset_size": 111212592
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.14.8+20261020-x86_64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8%2B20261020-x86_64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "1c891c5652f6ac56522baedba920064466cebbba7c3ccd1e35a0ff31aae68ef4",
+      "full_asset_size": 114456621
     },
     {
       "arch": "arm64",
       "target": "aarch64-unknown-linux-gnu",
       "python_version": "3.14.8",
-      "release": "20261001",
-      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8+20261001-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
-      "full_asset_name": "cpython-3.14.8+20261001-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
-      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261001/cpython-3.14.8%2B20261001-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
-      "full_asset_sha256": "15f23cb65278486f65c718e0fe706d131dd25ffb8bed99ef5676daf4ffebd9d3",
-      "full_asset_size": 96982577
+      "release": "20261020",
+      "install_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8+20261020-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+      "full_asset_name": "cpython-3.14.8+20261020-aarch64-unknown-linux-gnu-pgo+lto-full.tar.zst",
+      "full_asset_url": "https://github.com/astral-sh/python-build-standalone/releases/download/20261020/cpython-3.14.8%2B20261020-aarch64-unknown-linux-gnu-pgo%2Blto-full.tar.zst",
+      "full_asset_sha256": "37736480b609b184e2710f263bc8f27b7c326d5446a13ce2753846c5b8990d04",
+      "full_asset_size": 99809172
     }
   ]
 }
diff --git a/third_party/inventory.json b/third_party/inventory.json
index 5e3c384..a822ce1 100644
--- a/third_party/inventory.json
+++ b/third_party/inventory.json
@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "reviewed_on": "2026-08-29",
-  "refreshed_on": "2026-10-18",
+  "refreshed_on": "2026-10-21",
   "policy": {
     "source_of_truth": "versions.env",
     "maintenance": "Version changes require a reviewed inventory and notice update in the same pull request.",
@@ -180,19 +180,19 @@
       "name": "uv",
       "image_scope": "both",
       "version_key": "UV_VERSION",
-      "version": "0.13.1",
+      "version": "0.13.4",
       "source": "https://github.com/astral-sh/uv",
       "license": "Apache-2.0 OR MIT",
       "notices": [
         {
           "path": "components/uv/LICENSE-APACHE-2.0",
           "source": "repository",
-          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.1/LICENSE-APACHE"
+          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.4/LICENSE-APACHE"
         },
         {
           "path": "components/uv/LICENSE-MIT",
           "source": "repository",
-          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.1/LICENSE-MIT"
+          "reviewed_from": "https://raw.githubusercontent.com/astral-sh/uv/0.13.4/LICENSE-MIT"
         }
       ]
     },
diff --git a/third_party/standalone-artifact-inspection.json b/third_party/standalone-artifact-inspection.json
index 29da0bf..aff3cf9 100644
--- a/third_party/standalone-artifact-inspection.json
+++ b/third_party/standalone-artifact-inspection.json
@@ -173,7 +173,7 @@
     },
     {
       "id": "uv",
-      "version": "0.13.1",
+      "version": "0.13.4",
       "packaging": "tar.gz",
       "repository_notices": [
         {
@@ -190,16 +190,16 @@
       "architecture_legal_sets_equal": true,
       "architectures": {
         "amd64": {
-          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-x86_64-unknown-linux-gnu.tar.gz",
-          "asset_sha256": "eadd9d27c134ab5ac1ffd4473b97a741407f3ea238288f03121fc4deddf90220",
-          "asset_size": 16738706,
+          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-x86_64-unknown-linux-gnu.tar.gz",
+          "asset_sha256": "2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f",
+          "asset_size": 16653835,
           "archive_member_count": 3,
           "legal_members": []
         },
         "arm64": {
-          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.1/uv-aarch64-unknown-linux-gnu.tar.gz",
-          "asset_sha256": "9041c73c99fdc5892cf128140beb354eca9231d502068cc36e6cb53a8e59ad14",
-          "asset_size": 15838367,
+          "asset_url": "https://github.com/astral-sh/uv/releases/download/0.13.4/uv-aarch64-unknown-linux-gnu.tar.gz",
+          "asset_sha256": "1ae72b4718729e2ccc4f1ae2c6d1e531ca8467800e0546e9130b3886023a60ab",
+          "asset_size": 15769557,
           "archive_member_count": 3,
           "legal_members": []
         }
diff --git a/third_party/standalone-artifact-inspection.md b/third_party/standalone-artifact-inspection.md
index 4973851..6f30501 100644
--- a/third_party/standalone-artifact-inspection.md
+++ b/third_party/standalone-artifact-inspection.md
@@ -9,7 +9,7 @@ This is a bounded inspection of the exact AMD64 and ARM64 release assets pinned
 | codex-code-mode-host | `rust-v0.163.0` | tar.gz | None | LICENSE, NOTICE |
 | ttyd | `1.7.7` | raw-binary | None | LICENSE |
 | mise | `2026.10.13` | raw-binary | None | LICENSE |
-| uv | `0.13.1` | tar.gz | None | LICENSE-APACHE-2.0, LICENSE-MIT |
+| uv | `0.13.4` | tar.gz | None | LICENSE-APACHE-2.0, LICENSE-MIT |
 | yq | `4.54.1` | raw-binary | None | LICENSE |
 | shfmt | `3.14.1` | raw-binary | None | LICENSE |
 | actionlint | `1.7.12` | tar.gz | LICENSE.txt | LICENSE.txt |
diff --git a/versions.env b/versions.env
index 79c4374..7bdacbf 100644
--- a/versions.env
+++ b/versions.env
@@ -29,7 +29,7 @@ PYTHON_315_VERSION=3.15.0
 NODE_VERSION=24.22.0
 # Updated together with the other runtime pins by check-upstream.yml.
 NPM_VERSION=12.2.1
-UV_VERSION=0.13.1
+UV_VERSION=0.13.4
 RUFF_VERSION=0.17.1
 PYTEST_VERSION=9.1.1
 PRE_COMMIT_VERSION=4.7.0

From 1778353fcb2f02e081113b99d3b467ef422c992b Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:34:49 +0200
Subject: [PATCH 2/8] fix(security): correct Docker cache cleanup expansion

---
 images/base/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/images/base/Dockerfile b/images/base/Dockerfile
index 8faae44..6b96fa2 100644
--- a/images/base/Dockerfile
+++ b/images/base/Dockerfile
@@ -219,7 +219,7 @@ RUN test "$(stat -c '%a' "$MISE_SYSTEM_CONFIG_DIR")" = 755 \
         "$security_python" -I -c 'import pip; v=tuple(map(int,pip.__version__.split(".")[:3])); assert v >= (26,2,2), f"insecure pip {pip.__version__}"' || exit; \
         "$security_python" -I -m pip --version || exit; \
       done \
-    && rm -rf "${MISE_CACHE_DIR:?"}"/*
+    && rm -rf "${MISE_CACHE_DIR:?}"/*
 
 # Keep project and bundled-component terms inspectable in both the repository and
 # the built image. Runtime archives contribute their own license files here.

From e05884c13d13265369feaa1a42bd37aed3e21f34 Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:37:12 +0200
Subject: [PATCH 3/8] ci(security): one-shot regenerate exact Python CA legal
 evidence (#284)

---
 .../security-python-legal-refresh.yml         | 47 +++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 .github/workflows/security-python-legal-refresh.yml

diff --git a/.github/workflows/security-python-legal-refresh.yml b/.github/workflows/security-python-legal-refresh.yml
new file mode 100644
index 0000000..003fc3a
--- /dev/null
+++ b/.github/workflows/security-python-legal-refresh.yml
@@ -0,0 +1,47 @@
+name: Temporary Python CA legal regeneration (PR 286)
+
+on:
+  pull_request:
+    paths:
+      - 'mise.lock'
+      - 'third_party/components/python-build-standalone/**'
+      - 'third_party/components/python-build-standalone-315/**'
+      - '.github/workflows/security-python-legal-refresh.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  regenerate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - name: Checkout exact candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install archive extractor
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends zstd
+      - name: Regenerate full upstream Python standalone legal evidence
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          for ver in 3.14.8 3.15.0; do
+            if [[ "$ver" == 3.14.* ]]; then
+              out=third_party/components/python-build-standalone
+            else
+              out=third_party/components/python-build-standalone-315
+            fi
+            python3 scripts/sync-python-runtime-notices.py --write --python-version "$ver" --output "$out"
+            python3 scripts/compact-python-runtime-notices.py --write --python-version "$ver" --output "$out"
+          done
+          git status --short -- third_party/components/python-build-standalone third_party/components/python-build-standalone-315
+      - name: Preserve exact regenerated notices
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: regenerated-python-ca-notices
+          path: |
+            third_party/components/python-build-standalone/
+            third_party/components/python-build-standalone-315/
+          if-no-files-found: error
+          retention-days: 1

From 71dce85f902911e8c1c9048685c62ba36aae8173 Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:39:47 +0200
Subject: [PATCH 4/8] fix(security): accept upstream-native Python legal texts
 without redundant supplements

---
 scripts/compact-python-runtime-notices.py   |  4 ++--
 scripts/sync-python-runtime-notices.py      |  4 ++--
 scripts/test_sync_python_runtime_notices.py | 11 +++++++++++
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/scripts/compact-python-runtime-notices.py b/scripts/compact-python-runtime-notices.py
index c343033..9f086f1 100644
--- a/scripts/compact-python-runtime-notices.py
+++ b/scripts/compact-python-runtime-notices.py
@@ -206,8 +206,8 @@ def check(root: Path, output: Path, sync: ModuleType, python_version: str | None
         actual_digest = hashlib.sha256(content).hexdigest()
         if actual_digest != digest:
             fail(f"supplemental Python license digest mismatch: {path}")
-    if actual_supplemental != expected_supplemental:
-        fail("Python supplemental license sources do not match the reviewed mapping")
+    if not actual_supplemental.issubset(expected_supplemental):
+        fail("Python supplemental license manifest contains an unreviewed source")
 
     print("Compact Python standalone runtime notices: OK")
 
diff --git a/scripts/sync-python-runtime-notices.py b/scripts/sync-python-runtime-notices.py
index 40520c9..21d638f 100644
--- a/scripts/sync-python-runtime-notices.py
+++ b/scripts/sync-python-runtime-notices.py
@@ -416,8 +416,8 @@ def check(root: Path, output: Path, python_version: str | None = None) -> None:
         for entry in supplemental
         if isinstance(entry, dict)
     }
-    if actual_supplemental != expected_supplemental:
-        fail("Python supplemental license sources do not match the reviewed mapping")
+    if not actual_supplemental.issubset(expected_supplemental):
+        fail("Python supplemental license manifest contains an unreviewed source")
 
     print("Python standalone runtime notices: OK")
 
diff --git a/scripts/test_sync_python_runtime_notices.py b/scripts/test_sync_python_runtime_notices.py
index 91d8087..95b845e 100644
--- a/scripts/test_sync_python_runtime_notices.py
+++ b/scripts/test_sync_python_runtime_notices.py
@@ -159,6 +159,17 @@ def test_check_accepts_metadata_tied_to_current_lock(self) -> None:
                 json.dumps(manifest), encoding="utf-8"
             )
             self.sync.check(root, output)
+            # New upstream full archives can already include both historical
+            # missing licenses; no supplemental download is then necessary.
+            manifest["supplemental_licenses"] = []
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.sync.check(root, output)
+            # Unknown or substituted supplemental sources must remain rejected.
+            manifest["supplemental_licenses"] = [
+                {"source_url": "https://example.invalid/LICENSE", "sha256": "0" * 64}
+            ]
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.assert_rejected(self.sync.check, root, output)
 
 
 if __name__ == "__main__":

From b02d5d84aebc5accc0df06d4162cb50a0635bb57 Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:40:04 +0200
Subject: [PATCH 5/8] ci(security): regenerate Python CA legal evidence after
 synchronizer fix

---
 .github/workflows/security-python-legal-refresh.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/security-python-legal-refresh.yml b/.github/workflows/security-python-legal-refresh.yml
index 003fc3a..ab78712 100644
--- a/.github/workflows/security-python-legal-refresh.yml
+++ b/.github/workflows/security-python-legal-refresh.yml
@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - 'mise.lock'
+      - 'scripts/sync-python-runtime-notices.py'
+      - 'scripts/compact-python-runtime-notices.py'
       - 'third_party/components/python-build-standalone/**'
       - 'third_party/components/python-build-standalone-315/**'
       - '.github/workflows/security-python-legal-refresh.yml'

From 5d1bd2d1e08f7d87ecc8efaa79131d9e714d2ae3 Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:44:16 +0200
Subject: [PATCH 6/8] legal(security): commit exact 20261020 Python
 archive-derived notices

---
 .../amd64/license-metadata.json               |   9 +-
 .../arm64/license-metadata.json               |   9 +-
 .../licenses/LICENSE.openssl-1.1.txt          | 124 ------------------
 .../python-build-standalone-315/manifest.json |  13 +-
 .../amd64/license-metadata.json               |   9 +-
 .../arm64/license-metadata.json               |   9 +-
 .../licenses/LICENSE.openssl-1.1.txt          | 124 ------------------
 .../python-build-standalone/manifest.json     |  13 +-
 8 files changed, 10 insertions(+), 300 deletions(-)
 delete mode 100644 third_party/components/python-build-standalone-315/licenses/LICENSE.openssl-1.1.txt
 delete mode 100644 third_party/components/python-build-standalone/licenses/LICENSE.openssl-1.1.txt

diff --git a/third_party/components/python-build-standalone-315/amd64/license-metadata.json b/third_party/components/python-build-standalone-315/amd64/license-metadata.json
index d7a52b0..8fa9fcc 100644
--- a/third_party/components/python-build-standalone-315/amd64/license-metadata.json
+++ b/third_party/components/python-build-standalone-315/amd64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -133,11 +130,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone-315/arm64/license-metadata.json b/third_party/components/python-build-standalone-315/arm64/license-metadata.json
index 3f76a32..a3fa4a2 100644
--- a/third_party/components/python-build-standalone-315/arm64/license-metadata.json
+++ b/third_party/components/python-build-standalone-315/arm64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -133,11 +130,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone-315/licenses/LICENSE.openssl-1.1.txt b/third_party/components/python-build-standalone-315/licenses/LICENSE.openssl-1.1.txt
deleted file mode 100644
index 5b5ccdc..0000000
--- a/third_party/components/python-build-standalone-315/licenses/LICENSE.openssl-1.1.txt
+++ /dev/null
@@ -1,124 +0,0 @@
-
-  LICENSE ISSUES
-  ==============
-
-  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
-  the OpenSSL License and the original SSLeay license apply to the toolkit.
-  See below for the actual license texts.
-
-  OpenSSL License
-  ---------------
-
-/* ====================================================================
- * Copyright (c) 1998-2019 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
- Original SSLeay License
- -----------------------
-
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
diff --git a/third_party/components/python-build-standalone-315/manifest.json b/third_party/components/python-build-standalone-315/manifest.json
index c7ddb50..8612906 100644
--- a/third_party/components/python-build-standalone-315/manifest.json
+++ b/third_party/components/python-build-standalone-315/manifest.json
@@ -8,18 +8,7 @@
     "noopt"
   ],
   "shared_license_texts": true,
-  "supplemental_licenses": [
-    {
-      "path": "licenses/LICENSE.zlib-ng.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zlib-ng-2.2.4/LICENSE.md",
-      "sha256": "6c9f0d975b41afaa34d22f55bb8986ce69e5cb7ad327cb2b28820cd425edf5ee"
-    },
-    {
-      "path": "licenses/LICENSE.zstd.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zstd-1.5.7/LICENSE",
-      "sha256": "7055266497633c9025b777c78eb7235af13922117480ed5c674677adc381c9d8"
-    }
-  ],
+  "supplemental_licenses": [],
   "artifacts": [
     {
       "arch": "amd64",
diff --git a/third_party/components/python-build-standalone/amd64/license-metadata.json b/third_party/components/python-build-standalone/amd64/license-metadata.json
index 6408bb8..b05d5c9 100644
--- a/third_party/components/python-build-standalone/amd64/license-metadata.json
+++ b/third_party/components/python-build-standalone/amd64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -123,11 +120,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone/arm64/license-metadata.json b/third_party/components/python-build-standalone/arm64/license-metadata.json
index 971a223..41d4a13 100644
--- a/third_party/components/python-build-standalone/arm64/license-metadata.json
+++ b/third_party/components/python-build-standalone/arm64/license-metadata.json
@@ -21,7 +21,6 @@
     "licenses/LICENSE.libxcb.txt",
     "licenses/LICENSE.mpdecimal.txt",
     "licenses/LICENSE.ncurses.txt",
-    "licenses/LICENSE.openssl-1.1.txt",
     "licenses/LICENSE.openssl-3.txt",
     "licenses/LICENSE.sqlite.txt",
     "licenses/LICENSE.tcl.txt",
@@ -93,11 +92,9 @@
     "_hashlib": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
@@ -123,11 +120,9 @@
     "_ssl": [
       {
         "licenses": [
-          "Apache-2.0",
-          "OpenSSL"
+          "Apache-2.0"
         ],
         "license_paths": [
-          "licenses/LICENSE.openssl-1.1.txt",
           "licenses/LICENSE.openssl-3.txt"
         ]
       }
diff --git a/third_party/components/python-build-standalone/licenses/LICENSE.openssl-1.1.txt b/third_party/components/python-build-standalone/licenses/LICENSE.openssl-1.1.txt
deleted file mode 100644
index 5b5ccdc..0000000
--- a/third_party/components/python-build-standalone/licenses/LICENSE.openssl-1.1.txt
+++ /dev/null
@@ -1,124 +0,0 @@
-
-  LICENSE ISSUES
-  ==============
-
-  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
-  the OpenSSL License and the original SSLeay license apply to the toolkit.
-  See below for the actual license texts.
-
-  OpenSSL License
-  ---------------
-
-/* ====================================================================
- * Copyright (c) 1998-2019 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
- Original SSLeay License
- -----------------------
-
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
diff --git a/third_party/components/python-build-standalone/manifest.json b/third_party/components/python-build-standalone/manifest.json
index a4db112..ca17b2a 100644
--- a/third_party/components/python-build-standalone/manifest.json
+++ b/third_party/components/python-build-standalone/manifest.json
@@ -8,18 +8,7 @@
     "noopt"
   ],
   "shared_license_texts": true,
-  "supplemental_licenses": [
-    {
-      "path": "licenses/LICENSE.zlib-ng.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zlib-ng-2.2.4/LICENSE.md",
-      "sha256": "6c9f0d975b41afaa34d22f55bb8986ce69e5cb7ad327cb2b28820cd425edf5ee"
-    },
-    {
-      "path": "licenses/LICENSE.zstd.txt",
-      "source_url": "https://raw.githubusercontent.com/python/cpython-source-deps/zstd-1.5.7/LICENSE",
-      "sha256": "7055266497633c9025b777c78eb7235af13922117480ed5c674677adc381c9d8"
-    }
-  ],
+  "supplemental_licenses": [],
   "artifacts": [
     {
       "arch": "amd64",

From 811269a9c2b55ec11f3052a5d97adc03c5c7c7e3 Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:45:18 +0200
Subject: [PATCH 7/8] ci(security): remove one-shot Python legal regeneration
 workflow after verified audit

---
 .../security-python-legal-refresh.yml         | 49 -------------------
 1 file changed, 49 deletions(-)
 delete mode 100644 .github/workflows/security-python-legal-refresh.yml

diff --git a/.github/workflows/security-python-legal-refresh.yml b/.github/workflows/security-python-legal-refresh.yml
deleted file mode 100644
index ab78712..0000000
--- a/.github/workflows/security-python-legal-refresh.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-name: Temporary Python CA legal regeneration (PR 286)
-
-on:
-  pull_request:
-    paths:
-      - 'mise.lock'
-      - 'scripts/sync-python-runtime-notices.py'
-      - 'scripts/compact-python-runtime-notices.py'
-      - 'third_party/components/python-build-standalone/**'
-      - 'third_party/components/python-build-standalone-315/**'
-      - '.github/workflows/security-python-legal-refresh.yml'
-
-permissions:
-  contents: read
-
-jobs:
-  regenerate:
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
-    steps:
-      - name: Checkout exact candidate
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install archive extractor
-        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends zstd
-      - name: Regenerate full upstream Python standalone legal evidence
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -euo pipefail
-          for ver in 3.14.8 3.15.0; do
-            if [[ "$ver" == 3.14.* ]]; then
-              out=third_party/components/python-build-standalone
-            else
-              out=third_party/components/python-build-standalone-315
-            fi
-            python3 scripts/sync-python-runtime-notices.py --write --python-version "$ver" --output "$out"
-            python3 scripts/compact-python-runtime-notices.py --write --python-version "$ver" --output "$out"
-          done
-          git status --short -- third_party/components/python-build-standalone third_party/components/python-build-standalone-315
-      - name: Preserve exact regenerated notices
-        if: always()
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
-        with:
-          name: regenerated-python-ca-notices
-          path: |
-            third_party/components/python-build-standalone/
-            third_party/components/python-build-standalone-315/
-          if-no-files-found: error
-          retention-days: 1

From 56628a552831bffe7f65f3e5eb901f88721bb35b Mon Sep 17 00:00:00 2001
From: eXPerience83 <16572400+eXPerience83@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:54:08 +0200
Subject: [PATCH 8/8] fix(security): reject malformed Python supplemental
 notice records

---
 scripts/sync-python-runtime-notices.py      | 3 ++-
 scripts/test_sync_python_runtime_notices.py | 5 +++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/sync-python-runtime-notices.py b/scripts/sync-python-runtime-notices.py
index 21d638f..a090024 100644
--- a/scripts/sync-python-runtime-notices.py
+++ b/scripts/sync-python-runtime-notices.py
@@ -411,10 +411,11 @@ def check(root: Path, output: Path, python_version: str | None = None) -> None:
     expected_supplemental = {
         (entry["url"], entry["sha256"]) for entry in SUPPLEMENTAL_LICENSES.values()
     }
+    if not all(isinstance(entry, dict) for entry in supplemental):
+        fail("Python supplemental license records must be objects")
     actual_supplemental = {
         (entry.get("source_url"), entry.get("sha256"))
         for entry in supplemental
-        if isinstance(entry, dict)
     }
     if not actual_supplemental.issubset(expected_supplemental):
         fail("Python supplemental license manifest contains an unreviewed source")
diff --git a/scripts/test_sync_python_runtime_notices.py b/scripts/test_sync_python_runtime_notices.py
index 95b845e..b86e2d6 100644
--- a/scripts/test_sync_python_runtime_notices.py
+++ b/scripts/test_sync_python_runtime_notices.py
@@ -170,6 +170,11 @@ def test_check_accepts_metadata_tied_to_current_lock(self) -> None:
             ]
             (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
             self.assert_rejected(self.sync.check, root, output)
+            # A non-dictionary supplemental entry must fail even when its
+            # removal would otherwise make the approved subset look empty.
+            manifest["supplemental_licenses"] = [False]
+            (output / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+            self.assert_rejected(self.sync.check, root, output)
 
 
 if __name__ == "__main__":