Ilker ManapandClaude Opus 5.5
4466d2d15a
CI / test (push) Successful in 8m57s
Python pickles (.bin, .pt, .pth, .ckpt, .pkl) run whatever they hold when loaded, as the engine's user, on the node; that is how the malicious models found on Hugging Face work. The node refuses such a source, or a mirror set holding one, before fetching anything. A model added with one, or given one, is refused, while one already in the catalog still loads and is refused by its node with the same words. vLLM and SGLang downloading a model by its id get --load-format safetensors. The mirror page marks the file. allow_pickle: true on a model lets it through on purpose, carried to the node in EngineProfile.allow_pickle. BACKLOG M lists the rest: checksums against Hugging Face on every path, its own scan, trusted publishers, engines without the internet, an eval before an untrusted model serves. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
44 lines
1.5 KiB
Go
44 lines
1.5 KiB
Go
package weights
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/obs/obstest"
|
|
)
|
|
|
|
func TestAFetchSaysInItsTraceWhetherItDownloadedAndHowMuch(t *testing.T) {
|
|
rec := obstest.Record(t)
|
|
srv := serveBytes(t, []byte("forty gigabytes, give or take"), nil)
|
|
f := &Fetcher{CacheDir: t.TempDir()}
|
|
src := strings.Replace(srv.URL, "http://", "http://user:secret@", 1) + "/m/model.gguf?token=hunter2"
|
|
|
|
if _, err := f.Ensure(t.Context(), src, false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
fetch := rec.One(t, [16]byte{}, "fetch weights")
|
|
a := obstest.Attrs(fetch)
|
|
if a["llmgw.weights.outcome"] != "downloaded" {
|
|
t.Errorf("the first fetch says %v", a)
|
|
}
|
|
if strings.Contains(a["llmgw.weights.source"], "secret") || strings.Contains(a["llmgw.weights.source"], "hunter2") {
|
|
t.Errorf("the trace holds the source's credentials: %s", a["llmgw.weights.source"])
|
|
}
|
|
dl := rec.One(t, fetch.SpanContext().TraceID(), "download")
|
|
if !obstest.ChildOf(dl, fetch) || obstest.Attrs(dl)["llmgw.weights.bytes"] != "29" {
|
|
t.Errorf("the download does not say how much it moved: %v", obstest.Attrs(dl))
|
|
}
|
|
|
|
// The second start on this node finds it here.
|
|
if _, err := f.Ensure(t.Context(), src, false); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
again := rec.Named("fetch weights")
|
|
if len(again) != 2 || obstest.Attrs(again[1])["llmgw.weights.outcome"] != "cached" {
|
|
t.Errorf("the second fetch says %v", obstest.Attrs(again[len(again)-1]))
|
|
}
|
|
if len(rec.Named("download")) != 1 {
|
|
t.Error("a cached file was downloaded again")
|
|
}
|
|
}
|