Stop trusting the compromised eMudhra CA certificates

.github/workflows/certify-uk-release.yaml

@@ -58,7 +58,7 @@ permissions:
 
 env:
   LEDGER_BRANCH: uk-qualification-ledger
-  UV_VERSION: "0.12.14"
+  UV_VERSION: "0.13.4"
   PYTHON_VERSION: "3.13"
   # Keep equal to PYTHON_VERSION. The repository's .python-version asks for a
   # newer Python, and every uv command here must use the 3.13 environment the

.github/workflows/pr_code_changes.yaml

@@ -52,7 +52,7 @@ jobs:
         - name: Install uv
           uses: astral-sh/setup-uv@v8.1.0
           with:
-              version: "0.12.14"
+              version: "0.13.4"
         - name: Set up Python
           uses: actions/setup-python@v6
           with:
@@ -79,7 +79,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
         with:
-          version: "0.12.14"
+          version: "0.13.4"
       - name: Install package (no country-model extras)
         run: uv pip install --system .
       - name: Smoke-import core modules
@@ -97,7 +97,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
         with:
-          version: "0.12.14"
+          version: "0.13.4"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -155,7 +155,7 @@ jobs:
         - name: Install uv
           uses: astral-sh/setup-uv@v8.1.0
           with:
-              version: "0.12.14"
+              version: "0.13.4"
 
         - name: Set up Python
           uses: actions/setup-python@v6

.github/workflows/pr_docs_changes.yaml

@@ -26,7 +26,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
         with:
-          version: "0.12.14"
+          version: "0.13.4"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:

.github/workflows/push.yaml

@@ -59,7 +59,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
         with:
-          version: "0.12.14"
+          version: "0.13.4"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -128,7 +128,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
         with:
-          version: "0.12.14"
+          version: "0.13.4"
       - name: Setup Python
         uses: actions/setup-python@v6
         with:
@@ -184,7 +184,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
         with:
-          version: "0.12.14"
+          version: "0.13.4"
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -258,7 +258,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v8.1.0
         with:
-          version: "0.12.14"
+          version: "0.13.4"
       - name: Install policyengine without country models
         run: uv pip install -e . --system
       # The payload carries the certified UK bundle identity and, for an

changelog.d/698.fixed.md

@@ -0,0 +1 @@
+Stop trusting the compromised eMudhra (emSign) intermediate CA certificates in CI and in environments installed from `uv.lock`. The lock now pins certifi 2026.10.19 (was 2025.8.3), which removes the root "emSign ECC Root CA - G3", and hf-xet 1.7.0 (was 1.1.9), which checks certificates against the operating-system CA store instead of a compiled-in CA list that included that root. Every workflow now pins uv 0.13.4 (was 0.12.14), whose compiled-in CA list also removes it, and `uv.lock` is regenerated with that uv. The package's dependency ranges are unchanged.