pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
### Summary
The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the `emSign` root CA trust store certificate through the `certifi` distribution. It has since been removed through the bundle and the new version no longer includes them.
[pypi-publish]: https://github.com/marketplace/actions/pypi-publish
### Details
The `certifi`-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that [pypi-publish] relies on for Trusted Publishing and Digital Attestations.
### Related
The external compromise is being tracked at https://emudhra.we-have-a-problem.com
Affected packages:
- actions pypa/gh-action-pypi-publish: affected <= 1.14.2, fixed in 1.14.3