Critical advisory for pypa/gh-action-pypi-publish

Advisory overview

### Summary The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the `emSign` root CA trust store certificate through the `certifi` distribution. It has since been removed through the bundle and the new version no longer includes them. [pypi-publish]: https://github.com/marketplace/actions/pypi-publish ### Details The `certifi`-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that [pypi-publish] relies on for Trusted Publishing and Digital Attestations. ### Related The external compromise is being tracked at https://emudhra.we-have-a-problem.com

Affected packages and releases

Related references

• WEB
• PACKAGE