Follow-ups from the swamp-eval migration (swamp-club#4403)

3m ago

#4393

model output logs shows the latest log version instead of the output's own artifact version

5h ago

#4392

Manual: Sensitive Method Arguments claims a literal value is refused, but a method run accepts it

1h ago

#4391

workflow run: show artifact attributes for runs through serve, and let a run leave out the "Data produced" box

5h ago

#4386

Docs: what serve instances must not share, flat AWS Secrets Manager names, and where OAuth values are stored

53m ago

#4385

Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

4h ago

#4384

aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

7h ago

#4383

@swamp/cve http2shell, php-rce-2026-10 and tailworm: scan fails with 'Duplicate data instance name' (log and status share a name)

7h ago

#4381

swamp skill: add a workspace guide and routing-table entry

Enterprise20h ago

#4376

stagecraft tracker: relate tickets across trackers (another repo's tracker)

21h ago

#4373

serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request

23h ago

#4372

serve OAuth client reuse: remaining review findings from swamp-club#4264

23h ago

#4371

Agents.md: consider not using H1 'Project' inside managed block

1d ago

#4367

serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire

1d ago

#4365

serve: define what swamp serve does when its OAuth client is deleted at swamp-club

1d ago

#4360

Docs: schedule catch-up and missed-fire tracking for scheduled workflows

1d ago

#4359

Work-item commands run from the wrong repo report the work item as not started

1d ago

#4358

Docs: step concurrency caps only that step's forEach iterations, not its whole dependency level

1d ago

#4353

Package everything on ops.swamp-club.com; stop direct server edits

23h ago

#4347

workflow run: let a run skip the "Data produced" box, or make it show what each artifact holds

5h ago

#4342

Shorten swamp serve's token session re-check so revocation takes effect sooner

1d ago

#4336

@swamp/cve/emudhra: Ubuntu's pip vendored certifi reported as exposed although pip uses the OS store

1d ago

#4334

cfgmgmt firewall (ufw): an input for rule position (insert before/after)

Team1d ago

#4330

@swamp/video: informal demos — join multiple takes into one video, and a full-length background music bed

1d ago

#4329

agent-sessions: lockfile test helper silently depends on the captured @swamp/git key

1d ago

#4328

agent-sessions: low-severity edge cases from the Codex importer reviews (#4158)

1d ago

#4325

Team mode manual pages: swamp-serve and remote-execution for leader/follower, member checkouts, offline work, run control and known limits

2d ago

#4323

Agent session record: four questions from the Codex importer (#4158)

1d ago

#4318

@swamp/video: upload workflow to publish a take to YouTube (video, description, chapters, captions, thumbnail)

2d ago

#4315

@swamp/video/brand: customizable outro card (next steps, headline, per-video CTA)

2d ago

#4314

data prune through serve deletes data of an auto-definition whose declared type is invalid

2d ago

#4310

serve: give the definition index a change signal (file watcher with a sync barrier) so a write to a definitions directory costs O(1), not a stat of every file in it

2d ago

#4308

Warn when a grant with a methods list is a deny: it also refuses requests that name no method

2d ago

#4306

serve reload reports 0 types reloaded when it replaced edited repo-local behaviors

2d ago

#4305

@swamp/video/brand: cap each Chromium stderr line kept for errors

2d ago

#4301

serve resolves realpath for thousands of files under .swamp/outputs/swamp/worker/set_status

2d ago

#4299

Retention or GC for auto-definitions whose runs and data are gone

2d ago

#4293

S3 and GCS: after a real commit by another writer, a serve stays off the pull fast path until it restarts

2d ago

#4275

Licence header check only compares the first line of a file

2d ago

#4256

CI: an accepted attestation approves the PR, and anything else fails the attestation job

3d ago

#4238

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

3d ago

#4233

Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history

3d ago

#4232

Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild

3d ago

#4222

Add expiring service-account token requests and authorization checks to RBAC

Team4d ago

#4217

Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

4d ago

#4215

verify-build upgrade gate silently skips models whose version is a constant

4d ago

#4213

@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling

1d ago

#4212

agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)

4d ago

#4210

agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)

4d ago

#4202

Swamp Club collective GUI: show the swamp serve instances currently connected to a collective

Enterprise4d ago

← Back to list

01Issue

BugOpenExtensionsPublic

AssigneesNone

Relationships

#4336 @swamp/cve/emudhra: Ubuntu's pip vendored certifi reported as exposed although pip uses the OS store

Opened by muck · 11/3/2026

The scan rates a host High for /usr/lib/python3/dist-packages/pip/_vendor/certifi/cacert.pem ("pip vendored certifi"). Ubuntu (26.04, python3-pip 25.1.1+dfsg-1ubuntu2) patches pip's vendored certifi so where() returns /etc/ssl/certs/ca-certificates.crt. The bundled cacert.pem stays on disk but pip never reads it. The OS store on the same host is fixed (ca-certificates 20260816ubuntu0.26.04.1), so the High is a false positive.

Expected

For distro pip, use what pip._vendor.certifi.where() returns, or treat the Debian/Ubuntu build as using the OS store. Flag the vendored file only when pip actually loads it.

Environment

Extension 2026.10.25.1
Ubuntu 26.04.1

Related: #4259 (the same kind of distro false positive in @swamp/cve/http2shell)

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

Extension: @swamp/cve/emudhra@2026.10.25.1
swamp: 20261030.222321.0-sha.709f5920
OS: darwin (aarch64)
Deno: 2.9.8
Shell: /bin/zsh

02Bog Flow

Open

11/3/2026, 7:25:00 AM

No activity in this phase yet.

03Sludge Pulse

system commented 11/3/2026, 7:25:00 AM

Classified automatically when this issue was filed.

Source: Extensions

If you feel this classification is incorrect, add a ripple to tell us so.