Package: light-the-torch
light-the-torchlight-the-torchis a small utility that wrapspipto ease the installation process
for PyTorch distributions liketorch,torchvision,torchaudio, and so on as well
as third-party packages that depend on them. It auto-detects compatible CUDA versions
from the local setup and installs the correct PyTorch binaries without user
interference.Why do I need it?How do I install it?How do I use it?How does it work?Is it safe?How do I contribute?Why do I need it?PyTorch distributions liketorch,torchvision,torchaudio, and so on are fullypip install'able, but PyPI, the defaultpipsearch index, has some limitations:PyPI regularly only allows binaries up to a size ofapproximately 60 MB. One canrequest a file size limit increase(and the
PyTorch team probably does that for every release), but it is still not enough:
although PyTorch has pre-built binaries for Windows with CUDA, they cannot be
installed through PyPI due to their size.PyTorch uses local version specifiers to indicate for which computation backend the
binary was compiled, for exampletorch==1.11.0+cpu. Unfortunately, local specifiers
are not allowed on PyPI. Thus, only the binaries compiled with one CUDA version are
uploaded without an indication of the CUDA version. If you do not have a CUDA capable
GPU, downloading this is only a waste of bandwidth and disk capacity. If on the other
hand your NVIDIA driver version simply doesn't support the CUDA version the binary
was compiled with, you can't use any of the GPU features.To overcome this, PyTorch also hostsmost[^1] binarieson their own package indices. To access PyTorch's
package indices, you can still usepip install, but someadditional optionsare needed:pipinstalltorch--extra-index-urlhttps://download.pytorch.org/whl/cu113[^1]:
Some distributions are not compiled against a specific computation backend and thus
hosting them on PyPI is sufficient since they work in every environment.While this is certainly an improvement, it still has a few downsides:You need to know what computation backend, e.g. CUDA 11.3 (cu113), is supported on
your local machine. This can be quite challenging for new users and at least tedious
for more experienced ones.Besides the stable binaries, PyTorch also offers nightly and test ones. To install
them, you need a different--extra-index-urlfor each.For the nightly and test channel you also need to supply the--preoption. Failing
to do so, will pull the stable binary from PyPI even if the rest of the installation
command is correct.If any of these points don't sound appealing to you, and you just want to have the same
user experience aspip installfor PyTorch distributions,light-the-torchwas made
for you.How do I install it?Installinglight-the-torchis as easy aspipinstalllight-the-torchSince it depends onpipand it might be upgraded during installation,Windows usersshould
install it withpy-mpipinstalllight-the-torchHow do I use it?Afterlight-the-torchis installed you can use its CLI interfacelttas drop-in
replacement forpip:lttinstalltorchIn fact,lttispipwith a few added options:By default,lttuses the local NVIDIA driver version to select the correct binary
for you. You can pass the--pytorch-computation-backendoption to manually specify
the computation backend you want to use:lttinstall--pytorch-computation-backend=cu102torchtorchvisiontorchaudioBorrowing from the mutex packages that PyTorch provides forcondainstallations,--cpuonlyis available as shorthand for--pytorch-computation-backend=cu102.In addition, the computation backend to be installed can also be set through theLTT_PYTORCH_COMPUTATION_BACKENDenvironment variable. It will only be honored in
case no CLI option for the computation backend is specified.By default,lttinstalls stable PyTorch binaries. To install binaries from the
nightly or test channels pass the--pytorch-channeloption:lttinstall--pytorch-channel=nightlytorchtorchvisiontorchaudioIf--pytorch-channelis not passed, usingpip's builtin--preoption will
install PyTorch test binaries.Of course, you are not limited to install only PyTorch distributions. Everything shown
above also works if you install packages that depend on PyTorch:lttinstall--pytorch-computation-backend=cpu--pytorch-channel=nightlypysticheHow does it work?The authors ofpipdo not condonethe use ofpipinternals as they might break
without warning. As a results of this,piphas no capability for plugins to hook into
specific tasks.light-the-torchworks by monkey-patchingpipinternals at runtime:While searching for a download link for a PyTorch distribution,light-the-torchreplaces the default search index with an official PyTorch download link. This is
equivalent to callingpip installwith the--extra-index-urloption only for
PyTorch distributions.While evaluating possible PyTorch installation candidates,light-the-torchculls
binaries incompatible with the hardware.Is it safe?A project as large as PyTorch is attractive for malicious actors given the large user
base. For example in December 2022, PyTorch was hit by asupply chain attackthat
potentially extracted user information. The PyTorch team mitigated the attack as soon as
it was detected by temporarily hosting all third party dependencies for the nightly
Linux releases on their own indices. With that,pip install torch --extra-index-url https://download.pytorch.org/whl/cpuwouldn't pull
anything from PyPI and thus avoiding malicious packages placed there.However, due tolight-the-torch's index patching, this mitigation would have been
completely circumvented since only PyTorch distributions would have been installed from
the PyTorch indices. Since version0.7.0,light-the-torchwill only pull third-party
dependencies for nightly Linux PyTorch releases from PyPI in case they are specifically
requested and pinned. For exampleltt install --pytorch-channel=nightly torchandltt install --pytorch-channel=nightly torch sympywill install everything from the
PyTorch indices. However, if you pin a third party dependency, e.g.ltt install --pytorch-channel=nightly torch sympy==1.11.1, it will be pulled from PyPI
regardless of whether the version matches the one on the PyTorch index.In summary,light-the-torchis usually as safe as the regular PyTorch installation
instructions. However, attacks on the supply chain can lead to situations wherelight-the-torchcircumvents mitigations done by the PyTorch team. Unfortunately,light-the-torchis not officially supported and thus also not tested by them.How do I contribute?Thanks a lot for your interest to contribute tolight-the-torch! All contributions are
appreciated, be it code or not. Especially in a project like this, we rely on user
reports for edge cases we didn't anticipate. Please feel free toopen an issueif you encounter
anything that you think should be working but doesn't.If you want to contribute code, check out ourcontributing guidelinesto learn more about the workflow.