eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update

eMudhra's emSign intermediate Certificate Authority keys were compromised, putting Python package downloads and CI/CD pipelines at significant risk. The compromise affects tools like pip and uv that rely on certificate trust chains for secure dependency downloads. Users of Python virtual environments and CI/CD images that bundle affected certificates need to take immediate action. The article provides details on which tools and environments are affected, along with verified certificate-trust test results. Remediation steps are provided for pip, uv, virtual environments, and CI/CD images to remove or distrust the compromised certificates. This is a supply chain security issue with broad implications for Python developers and DevOps engineers worldwide.