pcr-fix

Files (2)

• SKILL.md
• playbooks.md · references/

SKILL.md (first lines)

# Fix (changes systems: approval required at every step)

Follow **pcr-navigator** rules: never disable TLS verification; upgrade pip from a
verified wheel; show each command and wait for a yes.

## 1. Start from the fix plan

`pycert-scan.py` writes `<out>-fix-plan.md` with exact commands per environment.
Walk through it in order. The playbooks in `references/playbooks.md` cover each
platform and the rollback.

## 2. Order

1. **Get the fixed wheels once** (`pip 26.2.2`, `certifi 2026.10.19`) by direct URL and
   **verify SHA-256** against the advisory (`PIP_WHEEL_SHA256`, `CERTIFI_WHEEL_SHA256`).
   A mismatch means stop.
2. **Per environment:** `python -m pip install ./pip-26.2.2-py3-none-any.whl`, then the
   certifi wheel. Now the fixed pip can safely update anything else.
3. **uv:** `UV_SYSTEM_CERTS=true uv self update` (or brew/pipx upgrade).
4. **OS trust stores:** apply the OS security update (ca-certificates). Required for
   `urllib`, `ssl.create_default_context()`, aiohttp and anything using the system store.
5. **New venvs:** update CPython to 3.15.1 / 3.14.9 / 3.13.17 where possible; on 3.12 and
   older, upgrade pip immediately after every `python -m venv`.
6. **Projects:** bump certifi/pip pins and re-lock; remove or bypass cooldowns for these
   packages; rebuild images with `--pull` and an explicit pip/certifi upgrade.
7. **Old Python (< 3.10):** see `references/playbooks.md` > Old Python.

## 3. After each change

Re-scan that environment (`--python <venv>`). Log what changed. Finish with
**pcr-verify-close**.

## Never

- `--trusted-host`, `verify=False`, `PYTHONHTTPSVERIFY=0`, `curl -k`, `UV_INSECURE_HOST`.
- Hand-editing CA bundles inside site-packages as a "fix" (it is overwritten and
  hides the real version); the workaround section explains the only acceptable cases.

From luivc1/python-cert-responder, MIT.

More from luivc1/python-cert-responder