[jychuah]

eMudhra / emSign CA compromise — EDM client 4.1.7

EDM verifies its connection to EDS against the CA bundle shipped inside the installer, and every EDM release through 4.1.6 ships a bundle from before the incident. EDM 4.1.7 (2026-10-23) carries certifi 2026.10.19 in the client bundle and in its embedded Python 3.11.16+3 runtime. The enthought/edm-* base images were rebuilt with 4.1.7 today (enthought/edm-containers#60).

What this PR changes

• .github/workflows/test-with-edm.yml: INSTALL_EDM_VERSION 3.3.1 → 4.1.7 and setup-edm-action@v1 → @v4.2 (the v1–v3 actions download from the pre-4.x rh6_x86_64/.../_linux_x86_64.sh layout and cannot fetch a 4.x installer). CI-only: the EDM client that downloads eggs and runtimes from EDS during the test run.

Rebuilding after merge also picks up Python runtime 3.11.16+3 and the certifi 2026.10.19 / pip 26.2.2 eggs from EDS, since the edm install calls here float on 3.11. No build or deploy is triggered by this PR.

Advisory: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

🤖 Generated with Claude Code

[jychuah]

CI note + fix: test-with-edm (macos-latest) failed in Set up EDM because there is no macOS build of EDM 4.1.7 (edm/osx_x86_64/4.1/edm_cli_4.1.7_osx_x86_64.pkg returns 403; EDM is supported on Linux and Windows only). Second commit keeps the macOS leg on 3.3.1 via a per-OS edm-version expression and moves Linux/Windows to 4.1.7. If you would rather drop the macOS EDM leg entirely, that is a one-line matrix change instead.

[jychuah]

Closing: codetools' etstool.py creates a Python 3.6 EDM environment (edm environments create codetools-test-3.6 --version=3.6). Under the 4.x client the platform defaults to rh8_x86_64, which has no 3.6 runtime ("No runtime available matching version '3.6'"), and the macOS leg has no 4.1.7 installer at all. The client bump here depends on moving the project to 3.11 (or passing --platform rh7_x86_64), which is the maintainers' call. Recorded in the org sweep as a finding; nothing merged.