Post by @dannyman@sfba.social
Apple's command-line utilities are still exposed to the recent eMudhra weak certificate problem, and will be until a pending software update.
MacOS command-line utilities do use the OS-built-in certificate store, but they (curl, git, python, pip, ruby, bunch of others including openssl, alarmingly) are not built to know about Apple's revocation lists.
So, something to have on the, ahem, radar. More somewhat unsatisfying information here: https://support.apple.com/en-us/149555
"If you want to address this before the software update, one option is [a bucket of awk pipe sudo, a flurry of brackets of every kind ]" is ... extremely out of character for Apple, so much so that I'm wondering if they're somehow caught in the middle of some larger process failure. They're not even bundling that up into something signed you can download and click?
@dannyman Small mercies but their proposed remedies all modify files carefully and in-situ, and aren't making the mistake I see an _awful lot_ of people making, of throwing dice trying to secure their connections by pulling in changes over unsecured connections.