Repository navigation
Security: eMudhra CA key compromise #1135
Description
The private keys of eight eMudhra intermediate certificate authorities (CAs) are weak and have been recovered, see https://emudhra.we-have-a-problem.com/. Anyone with these keys can create TLS certificates that unpatched clients accept, which makes it possible to intercept or tamper with downloads, for example from PyPI or GitHub. Python tools and packages often use their own certificate lists and these have to be upgraded. Suggested fixes are in (#1127)[(https://github.com//pull/1127].
ActivitySim users should generally
- Update uv to 0.13.4 or newer (check with
uv --version). uv is the recommended way to install ActivitySim.- Installed with the official script: run
uv self update --system-certs(uv 0.11 or newer) (note this assumes your machine automatically updates root certificates, check with IT if you are on a managed Windows machine). For older uv, reinstall with the official installer.
- Installed with the official script: run
- If you use pip, upgrade it to 26.2.2 or newer in every environment. Older pip always trusts its own bundled certificate list, even when your operating system blocks the CAs. The Python announcement linked above includes a checksum-pinned install command.
- Stop using the Windows installers attached to the v1.2.0 and v1.3.1 releases. They bundle outdated pip and certifi and are no longer maintained. Question: Should we delete the installer files from older releases? Side note, it looks like only v1.2.0 and v1.3.1 have installers attached?!
Note ActivitySim's own downloads (activitysim create) are checked against SHA-256 checksums for almost all example files, so a tampered file would be rejected.
Activity
guyrousseau commentedon Oct 22, 2026
@janzill, thank you for the detail. At ARC, this update will need to be applied to all our systems with pip currently installed. Our legacy installations will also be removed since they likely reference the now revoked CA.
janzill commentedon Oct 25, 2026
@guyrousseau Removing them is one option, but you can also try upgrading existing installations. After updating uv and pip (the latter in each environment), the steps depend on whether ActivitySim came from PyPI or a local clone/fork.
1. Environments managed with pip or
uv pipActivate the relevant environment and update certifi using
python -m pip install --upgrade "certifi>=2026.10.23"for pip, oruv pip install --upgrade "certifi>=2026.10.23"for uv pip.If you maintain a
requirements.txtor constraints file, update its old certifi requirement too, including hashes where applicable, so a later installation retains the fix.2. Projects installed with
uv sync --lockedIn the project’s
pyproject.toml, merge the following into the existing[tool.uv]section, retaining any other constraints:Then run:
Note if this for a setup where ActivitySim is a dependency of another project, apply this configuration in that project’s root, uv does not inherit
[tool.uv]constraints from dependencies.For developer installations, also add
"virtualenv>=21.14.12"and perform the same steps as for certifi above.