nvidia

/

RFD4-Proteina-Diffusers

Like 0

Follow

NVIDIA 72.3k

The Quickstart currently starts downloading dependencies without a patched pip bootstrap, and its pinned prep git+ install fails during Git partial-clone checkout.

This change:

• Bootstraps pip 26.2.2 with the SHA-256-pinned wheel from the Python security advisory, then upgrades certifi to >=2026.10.19 before dependency downloads.
• Replaces the prep git+ install with hf download --revision c9959efdebd75ac7fe9129fbbf0e291a6e0487d5 --local-dir rfd4-prep, followed by python -m pip install ./rfd4-prep. The prep revision is unchanged.
• Keeps Diffusers installed from GitHub until its next release, and retains accelerate in the current and future-release instructions.
• Uses python -m pip consistently and documents separate system/Git trust-store and native downloader checks, linking the cross-ecosystem incident guidance. Updating certifi does not establish that native binaries are patched.

Validation on macOS arm64, Python 3.12.10, Git 2.50.1 (Apple Git-155), huggingface_hub 2.2.0:

• The pinned prep pip command failed both unauthenticated and authenticated; an authenticated git clone --filter=blob:none also failed. All reported fatal: expected 'packfile' and failure to fetch blob a6344aac8c09253b3b630fb776ae94478aa0275b from the promisor remote. Authentication did not resolve it.
• The pinned hf download plus local install succeeded (using a separate rfd4-prep-pinned test directory), and python -m pip check reported No broken requirements found.
• In a fresh Python 3.12 venv, the companion prep PR's complete installation block also passed, including saved-login hf auth whoami, the PR checkout's package install, and the GitHub Diffusers install. Before the pinned-revision test, pip was 26.2.2, certifi was 2026.10.19, and pip check passed.
• Updated Quickstart bash syntax and whitespace checks pass. The combined Diffusers Quickstart was not rerun end-to-end; its bootstrap, prep download/install, and GitHub Diffusers install were exercised in the checks above. No model inference or native downloader TLS validation was performed.

Weights, model/code revision pins, and inference code are unchanged. Neither repository contains a Rust/Node build recipe or lockfile to patch.