* SECURITY UPDATE: ssl accepted TLS certificate chains signed by compromised eMudhra intermediate CA keys. Removing that trust is primarily the job of the platform root store, but until such an update reaches the OS, a container image or a trust bundle shipped inside a Python package, _ssl validated those chains normally. - debian/patches/CVE-2026-115557.patch: backport of cpython gh-160040 / GH-160042 (upstream shipped it in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2 only; 2.7 is EOL upstream). Adds the upstream denylist of eight distrusted SubjectPublicKeyInfo SHA-256 digests as Modules/_ssl_distrusted_spki.h (2.7 has no Modules/_ssl/ directory) and introduces the verify callback 2.7 lacks: every certificate OpenSSL accepts is hashed with i2d_X509_PUBKEY() + EVP_Digest() and rejected with X509_V_ERR_CERT_REJECTED when its key is on the list. Both SSL_CTX_set_verify() call sites install the callback, the body is rewritten in C89, Py_ARRAY_LENGTH() is replaced by a local macro, and the header is added to the _ssl Extension's depends in setup.py. - CVE-2026-115557