From 948099602129d835e7c6f4e282929eaf52d1d12f Mon Sep 17 00:00:00 2001 From: Stefan Walcz Date: Tue, 3 Nov 2026 14:37:06 +0000 Subject: [PATCH] fix(gallery): keep the pinned revision's sha256 in the checksum bot The checksum bot dropped the revision from URIs like .../resolve// and asked Hugging Face for the file on main. When the repo changed a file after the pin, the bot wrote main's sha256 next to a URI that still downloads the pinned file, so the install fails the checksum. Pass the revision to get_paths_info and hf_hub_download. Docs-Not-Needed: CI helper only, no user-facing behaviour changes Assisted-by: Claude Code:claude-opus-5-5 (cherry picked from commit fe16ba6f1c5c2da06bbb5b2ef3fca16533d98f24, mudler/LocalAI#12995; line endings of the file kept as on master) Signed-off-by: Ettore Di Giacinto --- .github/check_and_update.py | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/check_and_update.py b/.github/check_and_update.py index 704b658e6..ef6e61d84 100644 --- a/.github/check_and_update.py +++ b/.github/check_and_update.py @@ -7,17 +7,20 @@ import os uri = sys.argv[1] file_name = uri.split('/')[-1] -# Function to parse the URI and determine download method +# Function to parse the URI and determine download method. +# A URI that pins a revision (.../resolve//) downloads that +# revision, so its checksum has to come from the same revision, not from main. def parse_uri(uri): if uri.startswith('huggingface://'): repo_id = uri.split('://')[1] - return 'huggingface', repo_id.rsplit('/', 1)[0] + return 'huggingface', repo_id.rsplit('/', 1)[0], None elif 'huggingface.co' in uri: parts = uri.split('/resolve/') if len(parts) > 1: repo_path = parts[0].split('https://huggingface.co/')[-1] - return 'huggingface', repo_path - return 'direct', uri + revision = parts[1].split('/', 1)[0] + return 'huggingface', repo_path, revision + return 'direct', uri, None def calculate_sha256(file_path): sha256_hash = hashlib.sha256() @@ -38,7 +41,7 @@ def manual_safety_check_hf(repo_id): else: return None -download_type, repo_id_or_url = parse_uri(uri) +download_type, repo_id_or_url, revision = parse_uri(uri) new_checksum = None file_path = None @@ -51,7 +54,7 @@ if download_type == 'huggingface': print(f'Error: HuggingFace has detected security problems for {repo_id_or_url}: {str(hazard)}', filename=file_name) sys.exit(5) # Use HF API to pull sha - for file in get_paths_info(repo_id_or_url, [file_name], repo_type='model'): + for file in get_paths_info(repo_id_or_url, [file_name], repo_type='model', revision=revision): try: new_checksum = file.lfs.sha256 break @@ -60,7 +63,7 @@ if download_type == 'huggingface': sys.exit(2) if new_checksum is None: try: - file_path = hf_hub_download(repo_id=repo_id_or_url, filename=file_name) + file_path = hf_hub_download(repo_id=repo_id_or_url, filename=file_name, revision=revision) except Exception as e: print(f'Error from Hugging Face Hub: {str(e)}', file=sys.stderr) sys.exit(2)