ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix Linux prebuilt installs for branch-based llama.cpp releases (#5493)

Browse source 
* allow validation of custom releases to pass

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* require exact source provenance for branch direct linux releases

Mirror validated_checksums_for_bundle so incomplete checksum metadata
on a branch/pull/commit release fails closed with a clear error instead
of silently degrading to the legacy master-as-tag source hydration path
that this PR is meant to eliminate. Guard fires when source_commit,
the exact source archive hash, or a derivable source repo URL is
missing from the approved metadata.

Also set plan.llama_tag to approved_checksums.upstream_tag so the
ensure_converter_scripts fallback and the install fingerprint target
the concrete upstream tag (e.g. b9174) rather than the moving branch
label inferred from asset names (master). Legacy b#### releases are
unaffected: synthetic checksums already set upstream_tag to
bundle.upstream_tag, so the swap is a no-op on that path.

Add parametrized negative regression coverage for the three ways
exact provenance can be incomplete (missing source_commit, missing
exact source archive entry, missing source_repo) and update the
existing branch happy-path test to expect b9174.

* revert llama_tag swap to preserve install identity

Keep plan.llama_tag as bundle.upstream_tag (the branch label inferred
from asset names, e.g. master) rather than overriding it with the
approved metadata upstream tag (b9174). The override broke install
identity in two ways:

1. expected_install_fingerprint hashes upstream_tag = llama_tag, so
   the same release would produce a different fingerprint depending on
   which version of this code resolved it, causing spurious reinstalls
   when users upgrade or roll back.
2. UNSLOTH_PREBUILT_INFO.json reports the value as the user-visible
   record of which release was installed; tools and logs should see
   the requested branch label, not the compatibility tag.

The approved metadata still records upstream_tag = b9174 internally
for source archive lookup; the new assertion makes that explicit.

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Daniel Han <danielhanchen@gmail.com>
This commit is contained in:
DoubleMathew 2026-05-17 09:16:55 -05:00 • committed by GitHub
commit 77c8d80a85
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 298 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

32
studio/install_llama_prebuilt.py
View file

@ -1273,16 +1273,36 @@ def direct_linux_release_plan(
attempts.append(cpu_choice)
if not attempts:
raise PrebuiltFallback("no compatible Linux prebuilt asset was found")
approved_checksums = synthetic_checksums_for_release(
repo,
bundle.release_tag,
bundle.upstream_tag,
)
resolved_upstream_tag = bundle.upstream_tag
if DEFAULT_PUBLISHED_SHA256_ASSET in bundle.assets and not is_release_tag_like(
bundle.upstream_tag
):
approved_checksums = load_approved_release_checksums(repo, bundle.release_tag)
# Require exact source provenance for branch/pull/commit releases.
# Mirrors validated_checksums_for_bundle so incomplete metadata
# fails closed instead of degrading to the legacy branch-as-tag
# source hydration path that this PR is meant to eliminate.
if (
not approved_checksums.source_commit
or exact_source_archive_hash(approved_checksums) is None
or source_clone_url_from_checksums(approved_checksums) is None
):
raise PrebuiltFallback(
f"approved checksum asset {DEFAULT_PUBLISHED_SHA256_ASSET} for "
f"{repo}@{bundle.release_tag} did not contain exact source provenance"
)
attempts = apply_approved_hashes(attempts, approved_checksums)
return InstallReleasePlan(
requested_tag = requested_tag,
llama_tag = bundle.upstream_tag,
llama_tag = resolved_upstream_tag,
release_tag = bundle.release_tag,
attempts = attempts,
approved_checksums = synthetic_checksums_for_release(
repo,
bundle.release_tag,
bundle.upstream_tag,
),
approved_checksums = approved_checksums,
)

272
tests/studio/install/test_install_llama_prebuilt_logic.py
View file

@ -344,6 +344,278 @@ def test_validate_prebuilt_choice_creates_repo_shaped_linux_install(
assert (install_dir / "BUILD_INFO.txt").exists()
def test_simple_linux_direct_release_uses_published_source_checksums_for_branch(
monkeypatch: pytest.MonkeyPatch,
):
source_commit = "25b1bc9c2f9aa0a390b968ee1ffd9ff01340a3fe"
release = {
"tag_name": "llama-prebuilt-master-3a92bc9",
"assets": [
{
"name": "app-master-linux-x64-cuda13-newer.tar.gz",
"browser_download_url": "https://example.test/app-master-linux-x64-cuda13-newer.tar.gz",
},
{
"name": "llama-prebuilt-sha256.json",
"browser_download_url": "https://example.test/llama-prebuilt-sha256.json",
},
],
}
checksums = ApprovedReleaseChecksums(
repo = "unslothai/llama.cpp",
release_tag = "llama-prebuilt-master-3a92bc9",
upstream_tag = "b9174",
source_commit = source_commit,
source_repo = "ggml-org/llama.cpp",
source_repo_url = "https://github.com/ggml-org/llama.cpp",
source_ref_kind = "branch",
requested_source_ref = "master",
resolved_source_ref = "master",
artifacts = {
"app-master-linux-x64-cuda13-newer.tar.gz": ApprovedArtifactHash(
asset_name = "app-master-linux-x64-cuda13-newer.tar.gz",
sha256 = "a" * 64,
repo = "unslothai/llama.cpp",
kind = "linux-cuda-app",
),
INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name(
source_commit
): ApprovedArtifactHash(
asset_name = INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name(
source_commit
),
sha256 = "b" * 64,
repo = "ggml-org/llama.cpp",
kind = "exact-source",
),
},
)
monkeypatch.setattr(
INSTALL_LLAMA_PREBUILT,
"load_approved_release_checksums",
lambda repo, release_tag: checksums,
)
monkeypatch.setattr(
INSTALL_LLAMA_PREBUILT,
"detected_linux_runtime_lines",
lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}),
)
host = HostInfo(
system = "Linux",
machine = "x86_64",
is_windows = False,
is_linux = True,
is_macos = False,
is_x86_64 = True,
is_arm64 = False,
nvidia_smi = None,
driver_cuda_version = (13, 1),
compute_caps = ["100"],
visible_cuda_devices = None,
has_physical_nvidia = True,
has_usable_nvidia = True,
)
plan = INSTALL_LLAMA_PREBUILT.direct_linux_release_plan(
release,
host,
"unslothai/llama.cpp",
"latest",
)
assert plan is not None
assert plan.llama_tag == "master"
assert plan.approved_checksums.upstream_tag == "b9174"
assert plan.approved_checksums.source_commit == source_commit
assert plan.attempts[0].expected_sha256 == "a" * 64
source_repo, source_ref, _source_archive, exact_source = (
INSTALL_LLAMA_PREBUILT.preferred_source_archive(
plan.approved_checksums, plan.llama_tag
)
)
assert source_repo == "ggml-org/llama.cpp"
assert source_ref == source_commit
assert exact_source is True
@pytest.mark.parametrize(
"mutate, expected_match",
[
# Missing source_commit.
(
lambda c: setattr(c, "source_commit", None)
or setattr(c, "source_commit_short", None),
"exact source provenance",
),
# source_commit present, but no exact-source archive hash.
(
lambda c: c.artifacts.pop(
INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name(
c.source_commit
),
None,
),
"exact source provenance",
),
# source_commit + exact-source archive present, but no source_repo.
(
lambda c: setattr(c, "source_repo", None)
or setattr(c, "source_repo_url", None),
"exact source provenance",
),
],
ids = [
"missing_source_commit",
"missing_exact_source_artifact",
"missing_source_repo",
],
)
def test_simple_linux_direct_release_rejects_branch_without_exact_source_metadata(
monkeypatch: pytest.MonkeyPatch,
mutate,
expected_match,
):
source_commit = "25b1bc9c2f9aa0a390b968ee1ffd9ff01340a3fe"
release = {
"tag_name": "llama-prebuilt-master-3a92bc9",
"assets": [
{
"name": "app-master-linux-x64-cuda13-newer.tar.gz",
"browser_download_url": "https://example.test/app-master-linux-x64-cuda13-newer.tar.gz",
},
{
"name": "llama-prebuilt-sha256.json",
"browser_download_url": "https://example.test/llama-prebuilt-sha256.json",
},
],
}
checksums = ApprovedReleaseChecksums(
repo = "unslothai/llama.cpp",
release_tag = "llama-prebuilt-master-3a92bc9",
upstream_tag = "b9174",
source_commit = source_commit,
source_repo = "ggml-org/llama.cpp",
source_repo_url = "https://github.com/ggml-org/llama.cpp",
source_ref_kind = "branch",
requested_source_ref = "master",
resolved_source_ref = "master",
artifacts = {
"app-master-linux-x64-cuda13-newer.tar.gz": ApprovedArtifactHash(
asset_name = "app-master-linux-x64-cuda13-newer.tar.gz",
sha256 = "a" * 64,
repo = "unslothai/llama.cpp",
kind = "linux-cuda-app",
),
INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name(
source_commit
): ApprovedArtifactHash(
asset_name = INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name(
source_commit
),
sha256 = "b" * 64,
repo = "ggml-org/llama.cpp",
kind = "exact-source",
),
},
)
mutate(checksums)
monkeypatch.setattr(
INSTALL_LLAMA_PREBUILT,
"load_approved_release_checksums",
lambda repo, release_tag: checksums,
)
monkeypatch.setattr(
INSTALL_LLAMA_PREBUILT,
"detected_linux_runtime_lines",
lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}),
)
host = HostInfo(
system = "Linux",
machine = "x86_64",
is_windows = False,
is_linux = True,
is_macos = False,
is_x86_64 = True,
is_arm64 = False,
nvidia_smi = None,
driver_cuda_version = (13, 1),
compute_caps = ["100"],
visible_cuda_devices = None,
has_physical_nvidia = True,
has_usable_nvidia = True,
)
with pytest.raises(PrebuiltFallback, match = expected_match):
INSTALL_LLAMA_PREBUILT.direct_linux_release_plan(
release,
host,
"unslothai/llama.cpp",
"latest",
)
def test_simple_linux_direct_release_keeps_legacy_b_tag_path_without_checksums(
monkeypatch: pytest.MonkeyPatch,
):
release = {
"tag_name": "b9999",
"assets": [
{
"name": "app-b9999-linux-x64-cuda13-newer.tar.gz",
"browser_download_url": "https://example.test/app-b9999-linux-x64-cuda13-newer.tar.gz",
},
{
"name": "llama-prebuilt-sha256.json",
"browser_download_url": "https://example.test/llama-prebuilt-sha256.json",
},
],
}
def unexpected_checksum_load(repo: str, release_tag: str):
raise AssertionError(
"legacy b-tag direct releases should not require checksum metadata"
)
monkeypatch.setattr(
INSTALL_LLAMA_PREBUILT,
"load_approved_release_checksums",
unexpected_checksum_load,
)
monkeypatch.setattr(
INSTALL_LLAMA_PREBUILT,
"detected_linux_runtime_lines",
lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}),
)
host = HostInfo(
system = "Linux",
machine = "x86_64",
is_windows = False,
is_linux = True,
is_macos = False,
is_x86_64 = True,
is_arm64 = False,
nvidia_smi = None,
driver_cuda_version = (13, 1),
compute_caps = ["100"],
visible_cuda_devices = None,
has_physical_nvidia = True,
has_usable_nvidia = True,
)
plan = INSTALL_LLAMA_PREBUILT.direct_linux_release_plan(
release,
host,
"unslothai/llama.cpp",
"latest",
)
assert plan is not None
assert plan.llama_tag == "b9999"
assert plan.release_tag == "b9999"
assert plan.approved_checksums.source_commit is None
assert plan.attempts[0].expected_sha256 is None
def test_validate_prebuilt_choice_creates_repo_shaped_windows_install(
tmp_path: Path, monkeypatch: pytest.MonkeyPatch
):