[Bug] Default PyPI mirror disables TLS certificate verification for plugin dependencies

阅读 PipInstaller._build_pip_args() 和 test_install_adds_aliyun_trusted_host_only_for_aliyun_index 的测试；issue 表示两者都需要更新。移除自动设置 trusted-host 的行为，同时保留已配置的 index 参数，然后检查默认 index 和自定义 index 的情况是否都已覆盖。issue 还要求在所有 dashboard locale 中明确说明 pip_install_arg 提示。

Description

While following up on #10669 / #10670 and reviewing AstrBot's TLS handling, I found that the in-process pip installer disables TLS certificate verification for the default PyPI mirror.

PipInstaller._build_pip_args() appends --trusted-host mirrors.aliyun.com whenever the configured index is the default https://mirrors.aliyun.com/pypi/simple/. --trusted-host makes pip accept any certificate for that host, so an on-path attacker can present a self-signed certificate for mirrors.aliyun.com, serve crafted wheels, and get arbitrary code execution in the AstrBot process when plugin dependencies are installed. The default configuration is affected.

This is independent of the eMudhra CA incident from #10669 / #10670: the attack does not require a compromised CA key, only a network position and a certificate that pip would normally reject.

Reproduction Steps

1. Use AstrBot v4.29.1 with the default configuration (pypi_index_url defaults to https://mirrors.aliyun.com/pypi/simple/).

2. Install a plugin that declares dependencies, or otherwise trigger PipInstaller (plugin dependency install/update).

3. The pip argv logged by the installer contains --trusted-host mirrors.aliyun.com:

   Pip package manager argv: install -r requirements.txt --trusted-host mirrors.aliyun.com -i https://mirrors.aliyun.com/pypi/simple/
   

4. With an on-path proxy that terminates TLS for mirrors.aliyun.com using a self-signed certificate, pip accepts the connection and packages are downloaded without certificate verification. The packages are then installed and imported by plugins, which leads to arbitrary code execution.

Expected result: pip verifies the TLS certificate of the configured PyPI index, just like it does for any other HTTPS endpoint.

Actual result: Certificate verification is explicitly disabled for the default mirror.

AstrBot Version

v4.29.1 (master@0cd42bd4d)

Operating System

Linux

Deployment Method

Any (Docker, CLI, Windows Desktop)

Message Platform Adapter

N/A

Error Log

No error is raised; the insecure behavior is silent. The flag is visible in the generated pip argv, for example:

Pip package manager argv: install -r requirements.txt --trusted-host mirrors.aliyun.com -i https://mirrors.aliyun.com/pypi/simple/

Supplementary Information

History / source of this problem

• --trusted-host mirrors.aliyun.com was introduced in f8949ebea (2024-08-11, "perf: reboot after installing plugin") as a compatibility workaround when AstrBot switched its internal pip to the Aliyun mirror.
• 3756cb766 (2025-04-14, "支持自定义 PyPI 软件仓库地址", fixes #1165) kept the flag while making the PyPI index configurable; #1165 itself was only about not defaulting overseas users to the Aliyun mirror.
• The current Aliyun-only special case was added in #5954 (6da59cfb0, 2026-03-11), together with tests that codified the behavior (test_install_adds_aliyun_trusted_host_only_for_aliyun_index).

Why it can be removed now

• The current mirrors.aliyun.com certificate chain is anchored at GlobalSign Root R46, which is already included in certifi 2025.4.26 (the previous floor) and later versions.
• I verified that both pip 25.0.1 (vendored certifi 2024.08.30) and pip 26.2.2 can install from https://mirrors.aliyun.com/pypi/simple/ without --trusted-host.
• #10670 raises the floors to certifi>=2026.10.19 and pip>=26.2.2 (pip 26.2.2 vendors certifi 2026.10.19), so fresh installs/updates will have a modern trust store.
• Users with self-signed/private-CA mirrors keep an explicit migration path through pip_install_arg (--cert /path/to/ca.pem recommended, or explicit --trusted-host <host>); the same applies to plain-HTTP mirrors.

Proposed fix

Remove the automatic --trusted-host and the _get_trusted_host_for_index_url() helper from PipInstaller._build_pip_args(), keep the -i <index_url> argument, update the related tests, and clarify the pip_install_arg hint in all dashboard locales. I will submit a PR for this.

Checklist

• I have searched the Issue list for related issues and could not resolve the problem, or this issue has never been reported before.
• I have tried disabling all plugins to rule out issues caused by plugins.
• The issue I am reporting is related to AstrBot itself, not to a specific plugin.
• I have read and agree to the project's Code of Conduct.
• (Optional) I am willing to submit a PR to help fix this issue.