[rahultee]

Why

pip vendors its own certificate bundle. Updating the system CA package does not replace it. The installed pip 25.0.1 client still accepted the compromised chains listed at https://emudhra.we-have-a-problem.com/.

What changed

Upgrade pip to 26.2.2, which includes certifi 2026.10.19. Use its flit-core build backend. Apply the same package to the Python tools and Python base modules, without changing Python versions. Upstream supports Python 3.10 and newer.

This complements the system CA update in #494. The upstream Poetry change remains in #480.

Test plan

The pip derivations built successfully for Python 3.10, 3.11, 3.12 and 3.13. With the updated system CA bundle selected and the legacy CA directory excluded, pip's default truststore-backed session rejected both the direct and cross-signed test hosts on all four interpreters and accepted example.com.

Both module packaging paths evaluated successfully for all four interpreters. Changed-file formatting and git diff checks passed. No complete bundle build was run.

Rollout

Rebuild and distribute the affected Python modules together with the system CA update. Existing artifacts do not change until rebuilt. Custom user trust stores are not changed. Reverting restores the old certificate data and its unsafe trust.

• This is fully backward and forward compatible

~ written by ⠕ Replit