chia-cli-git

maintainer annikkitikkanen · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pypi.chia.net index is Chia Network's own official supplementary PyPI mirror, used specifically for their custom-built wheels (notably miniupnpc with Chia-specific patches). It is operated by the upstream vendor (Chia Network, Inc.) and is referenced in Chia's own official installation documentation and CI pipelines. This is analogous to PyTorch using download.pytorch.org or NVIDIA using their own index — an official vendor-operated supplementary index, not a random personal host. The pip install is done inside a Python venv that gets bundled into /opt/chia-blockchain, which is a common (if non-ideal) AUR pattern for complex Python applications. The sources are from the official Chia-Network GitHub org. The main concerns are quality/packaging issues (bundling a venv, sed-patching paths, no pinned git commits) rather than supply-chain malice. Rating as low rather than clean because the venv bundling pattern and extra-index-url do introduce some supply-chain surface area, but this is not a genuine medium-severity threat.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The pypi.chia.net index is Chia Network's own official supplementary PyPI mirror, used specifically for their custom-built wheels (notably miniupnpc with Chia-specific patches). It is operated by the upstream vendor (Chia Network, Inc.) and is referenced in Chia's own official installation documentation and CI pipelines. This is analogous to PyTorch using download.pytorch.org or NVIDIA using their own index — an official vendor-operated supplementary index, not a random personal host. The pip install is done inside a Python venv that gets bundled into /opt/chia-blockchain, which is a common (if non-ideal) AUR pattern for complex Python applications. The sources are from the official Chia-Network GitHub org. The main concerns are quality/packaging issues (bundling a venv, sed-patching paths, no pinned git commits) rather than supply-chain malice. Rating as low rather than clean because the venv bundling pattern and extra-index-url do introduce some supply-chain surface area, but this is not a genuine medium-severity threat.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:40 pip install --upgrade pip
PKGBUILD:41 pip install wheel
PKGBUILD:42 pip install --extra-index-url https://pypi.chia.net/simple/ miniupnpc==2.2.2

MEDIUM Package install from an untrusted index/registry host install_untrusted_index

An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.

PKGBUILD:42 pip install --extra-index-url https://pypi.chia.net/simple/ miniupnpc==2.2.2
PKGBUILD:43 pip install -e . --extra-index-url https://pypi.chia.net/simple/

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: Ben Westover <me@benthetechguy.net>
    
      2
    
      3pkgname='chia-cli-git'
    
      4pkgver=1.7.0.b2.r15.g5f706cea27
    
      5pkgrel=1
    
      6pkgdesc="A new blockchain and smart transaction platform that is easier to use, more efficient, and secure. - Latest git commit, CLI only"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://www.chia.net/"
    
      9license=('Apache')
    
      10install=chia-cli-git.install
    
      11depends=('python' 'openssl')
    
      12makedepends=('git')
    
      13conflicts=('chia-cli')
    
      14provides=('chia-cli')
    
      15options=('!strip')
    
      16source=("git+https://github.com/Chia-Network/chia-blockchain.git"
    
      17        "git+https://github.com/Chia-Network/mozilla-ca.git"
    
      18        "chia.sh")
    
      19sha256sums=('SKIP'
    
      20            'SKIP'
    
      21            'ff9b9ee5d8a8b0d8b2d2129431663b3d4a199fe47d8996cfcdf06183c48b6349')
    
      22
    
      23pkgver() {
    
      24	cd chia-blockchain
    
      25	git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      26}
    
      27
    
      28prepare() {
    
      29	cd chia-blockchain
    
      30	git submodule init mozilla-ca
    
      31	git config submodule.mozilla-ca.url "$srcdir/mozilla-ca"
    
      32	git -c protocol.file.allow=always submodule update mozilla-ca
    
      33}
    
      34
    
      35build() {
    
      36	cd chia-blockchain 
    
      37	python -m venv venv
    
      38	ln -s venv/bin/activate
    
      39	source activate
    
      40	pip install --upgrade pip
    
      41	pip install wheel
    
      42	pip install --extra-index-url https://pypi.chia.net/simple/ miniupnpc==2.2.2
    
      43	pip install -e . --extra-index-url https://pypi.chia.net/simple/
    
      44}
    
      45
    
      46package() {
    
      47	mkdir -p "$pkgdir/opt"
    
      48	mv chia-blockchain "$pkgdir/opt"
    
      49	install -Dm755 chia.sh "$pkgdir/usr/bin/chia"
    
      50
    
      51	# replace references to srcdir with final install location
    
      52	find "$pkgdir/opt/chia-blockchain" -type f -exec sed -i "s|${srcdir}|/opt|g" {} \;
    
      53	# remove compiled python modules because they contain references to srcdir
    
      54	find "$pkgdir/opt/chia-blockchain" -name '*.pyc' -delete
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3