[rishiy15]

What

Patch release that stops the SDK on Linux from trusting the eight eMudhra intermediate CA certificates whose private keys were disclosed on 2026-10-20. Tracking: INFRASEC-1824.

• 4df1453: replaces only the Linux libop_uniffi_core.so (x86_64, aarch64)
• dc722ad: Release v0.4.2 (version 0.4.2, build 0040201, release notes)

Why only Linux

The SDK's TLS goes through op-tls → rustls-platform-verifier:

• Linux: verification is rustls-webpki against the system roots plus bundled Mozilla roots (webpki-root-certs), which op-tls adds on Linux only. The v0.4.1 libs ship rustls-webpki 0.103.9 and a bundle that includes emSign ECC Root CA - G3, so a patched system CA store doesn't help.
• macOS / Windows: verification is done by the OS (SecTrust / CertGetCertificateChain). The dylibs and dll contain no bundled roots, so rebuilding them changes nothing. Users there depend on Apple's and Microsoft's distrust updates.

Where the libs come from

Built from agilebits-inc/sdk-core#509 (branch release/sdk-python-0.4.x), which is the same sdk-core commit that built v0.4.1's libs (3d49ce29, core 9fc9cf63, public-beta channel, via sdk-core/beta/2026-02-09-3d49ce29 / #210 → #239). The only functional change is Cargo.lock: rustls-webpki 0.103.9 → 0.103.16 (rejects chains containing the distrusted intermediate SPKIs) and webpki-root-certs 1.0.5 → 1.0.10 (drops emSign ECC Root CA - G3). This avoids shipping ~8 months of unrelated core changes from sdk-core main in a security patch.

Not built with publish.yml. It only runs from main, so it would generate client code from main's core (85a634af) on top of February libs. It also needs all four platform artifacts, and it overwrites the x86_64 .so with the arm64 one (both download into the same flat directory). The libs were copied by hand from the CI artifacts below.

Provenance (for reviewers to re-check)

sdk-core build run	39679159453 (head 2394c74b)
uniffi-linux-amd64-public-beta artifact digest	sha256:132b8ca67bd1e77594ba93c8da8f8ad67dfeec2a11c3843a5a09d09dbcf0246c
uniffi-linux-arm64-public-beta artifact digest	sha256:a2c029af5400004e039057846ce3931b81a49123e5c96850306d8cb6874cd8d9
lib/x86_64/libop_uniffi_core.so sha256	d030d05c5dca54f82c6cf8a4c00e82b19734d1ce6f5dfa2e5702c3cd2cd060d7
lib/aarch64/libop_uniffi_core.so sha256	e5238beee526bfc6cc8a59d136a95ad062a433969c5b4c5af4d74924b533eae3

gh run download 39679159453 -R agilebits-inc/sdk-core -n uniffi-linux-amd64-public-beta -D /tmp/amd64
gh run download 39679159453 -R agilebits-inc/sdk-core -n uniffi-linux-arm64-public-beta -D /tmp/arm64
shasum -a 256 /tmp/amd64/libop_uniffi_core.so /tmp/arm64/libop_uniffi_core.so

Verification

• grep -a -c "emSign ECC Root CA - G3": 2 → 0 in both .so (also 0 inside the built wheels)
• strings: rustls-webpki 0.103.9 → 0.103.16 in both .so
• Sizes within ~5 KB of v0.4.1's (main-based build was ~40% larger)
• Generated op_uniffi_core.py from #509 byte-identical to the committed one (no API change)
• manylinux_2_32 x86_64/aarch64 wheels build and contain the new libs
• sdk-core#509 CI: Linux builds, unit tests, extism integration tests, static-check green (Rust 1.92.0)
• test-trusted matrix on this PR (integration tests load the new .so on ubuntu)
• sdk-core#509 reviewed and merged into release/sdk-python-0.4.x
• Post-release: pip install onepassword-sdk==0.4.2 on Linux and re-check the G3 grep on the installed .so

Release (after approval)

Following src/release/README.md from this branch: make build-wheels → make release (signed tag v0.4.2, GitHub release, PyPI upload), then merge this PR to main. Then post in #technical-writer-review-requests. Whether to publish a security advisory is a call for InfraSec.

[github-actions]

⚠️ This PR contains unsigned commits. To get your PR merged, please sign those commits (git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}) and force push them to this branch (git push --force-with-lease).

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

1. Generate a GPG key
2. Add the GPG key to your GitHub account
3. Configure git to use your GPG key for commit signing

Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

1. Generate an SSH key and add it to ssh-agent
2. Add the SSH key to your GitHub account
3. Configure git to use your SSH key for commit signing

Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.

Learn how to use 1Password to sign your commits.