Repository navigation
[security] Mitigate eMudhra/emSign CA incident in dependency resolution, CI, and CLI installs : Issue #79 - #81
Open
Shreyavemana wants to merge 32 commits into
Conversation
…ase PR. Keep pyproject.toml and uv.lock in sync, skip a bump while a version is still unpublished, and only hit the PyPI environment when an upload will actually run.
Bring the bump/publish workflows in line with develop (via main) so the PR can merge.
…ure/release-automation Automate version bumps and PyPI publishes from main
…ase/0.4.0 Release version bump to 0.4.0
.env values were written over os.environ unconditionally, so the PORT=3000 that `nitrostack init` puts in .env overrode the PORT a host passes when starting the server. NitroStudio starts a second project on 3001; it bound 3000 anyway and died with "address already in use" (NITSTD-222). Keys already in the process environment are now kept, as with python-dotenv and Node's dotenv. .env still fills keys the process doesn't set, and defaults stay lowest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…process-env-wins-over-dotenv ConfigService: process environment wins over .env
…ase/0.4.1 chore(release): 0.4.1
publish.yml only uploads through PyPI trusted publishing, which has never run here, and the Bump version workflow can't open its release PR (the org doesn't allow GitHub Actions to create pull requests). The script covers both: optionally makes release/<next> from origin/main (--bump), checks the branch matches origin, the lockfile matches and the version is new, runs the tests, builds, twine-checks, uploads after asking, verifies a clean install from PyPI, and opens the release PR. `--tag` tags origin/main after the merge. `--dry-run` stops before anything leaves the machine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Run from a temp copy: --bump switches branches, which can rewrite the script while bash is still reading it. - --bump plans from origin/main's files in a scratch folder and checks everything before switching, so a failed check no longer leaves you on a detached origin/main. - Only a 404 counts as "not on PyPI"; offline or PyPI errors stop the run instead of passing the "version is new" check. - No terminal and no --yes means "no" instead of a silent exit. - Tag the uploaded commit right after the upload (no separate step that could tag later, unreleased merges on main). --tag stays for catching up untagged releases and prefers the release branch head. - A failed PR creation after the upload prints the manual step. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The README is the PyPI project page. Rewrite it for 0.4.x: building blocks (tools, resources, prompts, guards, auth, caching, rate limits, tasks, events, health), env precedence, templates, clients. tests/test_readme_examples.py compiles every python block, checks every nitrostack import exists, and runs the Quick Start and Building Blocks examples through the testing harness so the page can't drift. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e/release-script Add scripts/release.sh for releasing to PyPI by hand
…/readme-refresh docs: refresh README (PyPI page) for the current SDK
`nitrostack-py upgrade` failed on every project `init` creates: the
dependency pattern also matched `nitrostack = { path = "vendor/nitrostack" }`
in [tool.uv.sources] and produced an invalid pyproject.toml. Spec rewrites
are now limited to [project].dependencies, and the pattern skips paths
ending in /nitrostack.
Fixing that alone isn't enough: a vendored project runs vendor/nitrostack
whatever spec it declares, and uv accepts a spec the vendored copy doesn't
satisfy. For vendored projects, upgrade now replaces vendor/nitrostack
with the target release (copied from the running CLI when it is that
release, otherwise the PyPI wheel, checked against its sha256). The new
tree is built beside the old one and swapped in, so a failed download
leaves the project as it was.
init's next steps said NitroStudio can't open Python projects; it can.
The pizzaz open-shops hint is printed only for the pizzaz template.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…upgrade-vendored Fix upgrade on vendored projects; correct init's NitroStudio note
…ase/0.4.2 chore(release): 0.4.2
`init` vendors the SDK into vendor/nitrostack. `validate` walked it as project code, and nitrostack/testing applies @mcp_app to a class defined inside a function, so every vendored project that imported nitrostack.testing failed with "uses @mcp_app but no decorated application class was found after import". Compose's typecheck runs `validate`, so a NitroStudio build could not get past it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…validate-skip-vendored-sdk validate: skip the vendored SDK
Align Python pack with the TypeScript CLI: optional inclusion of .env files in the wheel, with a warning that lists paths without printing values.
…/pack-include-env pack: add --include-env
…/producthunt-badge docs: add Product Hunt featured badge to README
…e Day top-post badge
…/producthunt-top-post-badge docs: update Product Hunt badge to nitrocloudofficial#1 Product of the Day top-post badge
…ta-csp docs: document widget data and CSP handling
…pip bootstrap, uv gate)
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mitigates the eMudhra/emSign CA certificate security incident by updating certificate dependencies and securing pip/uv installation paths across CI, publishing workflows, and the CLI.
Changes
certifito2026.10.19or later in dependency declarations anduv.lock.26.2.2bootstrapping to test and publish workflows.nitrostack-py installto securely upgrade pip before installing packages and reject uv versions older than0.13.4.Tests
tests/test_cli_install_security.pyfor pip bootstrapping, version parsing, uv version checks, and failure handling.tests/test_security_config.pyfor dependency versions and CI workflow configuration.tests/test_cli_install.pyto accommodate the new version checks.pytest-timeoutwas initially unavailable; Ruff was not installed).Documentation
Added a README section covering the incident, minimum fixed versions, and recommendations to update existing virtual environments, refresh lockfiles, and rebuild affected container images.