[staging CI] unslothai/unsloth#8579 - #276
Open
danielhanchen wants to merge 5 commits into
Open
Conversation
…p.conf
A machine with security-hardened package-manager config could not install
Studio. With `no-build = true` in ~/.config/uv/uv.toml, the "unsloth extras"
step failed because extras.txt carries requirements that ship no wheel on PyPI
at any version, and uv correctly refused to build them:
x No solution found when resolving dependencies:
`-> Because openai-whisper==20250625 has no usable wheels [...]
hint: building from source is disabled for all packages (--no-build)
The pip fallback then hit `require-hashes = true` in ~/.config/pip/pip.conf and
rejected every requirement, since the shipped requirements files are pinned but
unhashed.
The wheel-less requirements are already audited and allowlisted for source
builds in .github/scripts/clean-machine-assert.sh, so the installer now names
them explicitly with a package-scoped --no-binary. That overrides a global
no-build / only-binary policy for those four names only, and leaves the user's
binary-only policy in force for every other requirement. A blanket --no-build
or `--no-binary :none:` override would have discarded the policy entirely.
Hash-required mode has no command-line equivalent, so it is switched off in the
child environment of the installer's own pip commands. pip applies environment
variables after config files, so index-url, trusted-host, cert and proxy
settings from pip.conf all stay in force, and uv commands are untouched. The
override never reaches os.environ, so the user's own later pip commands keep
their policy.
Pinned-index installs additionally drop the restrictive UV_* / PIP_* variables.
That branch already neutralised the config files, but an environment variable
outranks a config file, so a hardened shell could still fail a torch repair the
pin was supposed to make deterministic.
Fixes #8530
for more information, see https://pre-commit.ci
Two paths still aborted under a user-level `no-build = true` once the extras
step was fixed.
The pinned Diffusers revision is a source ARCHIVE, and uv refuses to build one
under no-build ("Building source distributions for `diffusers` is disabled"),
so a hardened host died at "diffusers pin" instead. That step runs on every
platform for python >= 3.10, which includes the macOS host in the report. The
exemption is guarded on the version marker because python < 3.10 resolves a
released wheel from diffusers-pin.txt that must not be forced through a source
build.
extras.txt pins MeCab==0.996.5 on macOS cp314 and up, the last release carrying
an sdist, so no-build refuses it there too. MeCab is a C extension, so the
exemption is conditional: every other host resolves 0.996.13 from a wheel and
must not be pushed into a compiler-dependent build.
Verified against uv 0.10 with a cold cache, which matters here: a warm cache
reuses the wheel it already built for the archive and hides the failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Disposable CI run for unslothai/unsloth#8579. Do not merge; closed after CI.