Buckets:

hf-doc-build
/

doc-dev

Files
xet
hf-doc-build/doc-dev / kernels /pr_871 /en /security.html
HuggingFaceDocBuilder
16 days ago
download
raw
34.6 kB
<meta charset="utf-8" /><meta name="hf:doc:metadata" content="{&quot;title&quot;:&quot;Kernels security&quot;,&quot;local&quot;:&quot;kernels-security&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Malicious kernel developers&quot;,&quot;local&quot;:&quot;malicious-kernel-developers&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Trusted publishers&quot;,&quot;local&quot;:&quot;trusted-publishers&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3},{&quot;title&quot;:&quot;kernels-community&quot;,&quot;local&quot;:&quot;kernels-community&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3},{&quot;title&quot;:&quot;Kernel provenance&quot;,&quot;local&quot;:&quot;kernel-provenance&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3}],&quot;depth&quot;:2},{&quot;title&quot;:&quot;Kernel compromises&quot;,&quot;local&quot;:&quot;kernel-compromises&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Kernel locking&quot;,&quot;local&quot;:&quot;kernel-locking&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3},{&quot;title&quot;:&quot;Code signing&quot;,&quot;local&quot;:&quot;code-signing&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Signature verification receipts&quot;,&quot;local&quot;:&quot;signature-verification-receipts&quot;,&quot;sections&quot;:[],&quot;depth&quot;:4}],&quot;depth&quot;:3}],&quot;depth&quot;:2}],&quot;depth&quot;:1}"/>
		<link href="/docs/kernels/main/en/_app/immutable/entry/start.BJAz11b3.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/Re4Wk0Su.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/DfHjNWj2.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/entry/app.DtzmdH2K.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/Ba1drWuH.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/BWzB-uRo.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/DsnmJJEf.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/PGLvW8OU.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/nodes/0.CqW1WYOO.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/CFswWuIO.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/nodes/38.KBy01ddX.js" rel="modulepreload">
		<link href="/docs/kernels/main/en/_app/immutable/chunks/CyvF58-O.js" rel="modulepreload">
		<!--4rm2pb--><meta name="hf:doc:metadata" content="{&quot;title&quot;:&quot;Kernels security&quot;,&quot;local&quot;:&quot;kernels-security&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Malicious kernel developers&quot;,&quot;local&quot;:&quot;malicious-kernel-developers&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Trusted publishers&quot;,&quot;local&quot;:&quot;trusted-publishers&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3},{&quot;title&quot;:&quot;kernels-community&quot;,&quot;local&quot;:&quot;kernels-community&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3},{&quot;title&quot;:&quot;Kernel provenance&quot;,&quot;local&quot;:&quot;kernel-provenance&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3}],&quot;depth&quot;:2},{&quot;title&quot;:&quot;Kernel compromises&quot;,&quot;local&quot;:&quot;kernel-compromises&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Kernel locking&quot;,&quot;local&quot;:&quot;kernel-locking&quot;,&quot;sections&quot;:[],&quot;depth&quot;:3},{&quot;title&quot;:&quot;Code signing&quot;,&quot;local&quot;:&quot;code-signing&quot;,&quot;sections&quot;:[{&quot;title&quot;:&quot;Signature verification receipts&quot;,&quot;local&quot;:&quot;signature-verification-receipts&quot;,&quot;sections&quot;:[],&quot;depth&quot;:4}],&quot;depth&quot;:3}],&quot;depth&quot;:2}],&quot;depth&quot;:1}"/><!---->
		<link href="/docs/kernels/main/en/_app/immutable/assets/0.tn0RQdqM.css" rel="modulepreload"> <!--[--><!--[0--><!--[--><!--[0--><!--[--><p></p> <div class="items-center shrink-0 min-w-[100px] max-sm:min-w-[50px] justify-end ml-auto flex" style="float: right; margin-left: 10px; display: inline-flex; position: relative; z-index: 10;"><div class="inline-flex rounded-md max-sm:rounded-sm"><button class="inline-flex items-center gap-1 h-7 max-sm:h-7 px-2 max-sm:px-1.5 text-sm font-medium text-gray-800 border border-r-0 rounded-l-md max-sm:rounded-l-sm border-gray-200 bg-white hover:shadow-inner dark:border-gray-850 dark:bg-gray-950 dark:text-gray-200 dark:hover:bg-gray-800" aria-live="polite"><span class="inline-flex items-center justify-center rounded-md p-0.5 max-sm:p-0 hover:text-gray-800 dark:hover:text-gray-200"><svg class="sm:size-3.5 size-3" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" fill="currentColor" focusable="false" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 32 32"><path d="M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z" transform="translate(0)"></path><path d="M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z" transform="translate(0)"></path><rect fill="none" width="32" height="32"></rect></svg><!----></span> <span>Copy page</span></button> <button class="inline-flex items-center justify-center w-6 max-sm:w-5 h-7 max-sm:h-7 disabled:pointer-events-none text-sm text-gray-500 hover:text-gray-700 dark:hover:text-white rounded-r-md max-sm:rounded-r-sm border border-l transition border-gray-200 bg-white hover:shadow-inner dark:border-gray-850 dark:bg-gray-950 dark:text-gray-200 dark:hover:bg-gray-800" aria-haspopup="menu" aria-expanded="false" aria-label="Open copy menu"><svg class="transition-transform text-gray-400 overflow-visible sm:size-3.5 size-3 rotate-0" width="1em" height="1em" viewBox="0 0 12 7" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M1 1L6 6L11 1" stroke="currentColor"></path></svg><!----></button></div> <!--[-1--><!--]--></div><!----> <!--[0--><h1 class="relative group"><a id="kernels-security" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#kernels-security"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Kernels security</span></h1><!--]--><!----> <p><code>kernels</code> downloads and loads remote code, so you need clear trust boundaries.
We aim to address the following attack vectors:</p> <ul><li>A kernel developer ships malicious code inside a kernel.</li> <li>The Hub credentials of a kernel developer are compromised and an attacker uses
them to add malicious code to a kernel.</li></ul> <p>We do not aim to address the following attack vectors:</p> <ul><li>Local Hub cache manipulation if the manipulation is done by the attacker on
the system that loads the kernels. The reasoning here is that the attacker
could do anything at this point, including tampering with the software that
loads the kernel.</li></ul> <p>Improving kernel security is an ongoing effort, and we welcome feedback and
contributions.</p> <!--[1--><h2 class="relative group"><a id="malicious-kernel-developers" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#malicious-kernel-developers"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Malicious kernel developers</span></h2><!--]--><!----> <p>As a <code>kernels</code> user, ask two trust questions before you load a kernel:</p> <ul><li>Do I trust the developer?</li> <li>Do I trust the developer to properly secure their infrastructure and
credentials?</li></ul> <p><code>kernels</code> also blocks accidental loads from publishers you have not opted into,
such as from trusted publishers, the <a href="https://huggingface.co/kernels-community" rel="nofollow">kernels-community</a>, and kernel
provenance.</p> <!--[2--><h3 class="relative group"><a id="trusted-publishers" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#trusted-publishers"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Trusted publishers</span></h3><!--]--><!----> <p>A trusted publisher is a kernel developer who is deemed reputable by the Hugging
Face kernels team. The trusted publisher status is queried from the Hub when
downloading a kernel.</p> <p>The set of trusted publishers is intentionally very small and generally only
contains organizations that have years of experience in developing kernels and
maintaining secure build infrastructure.</p> <p>By default, a call such as</p> <div class="code-block relative "><div class="absolute top-2.5 right-4"><button class="inline-flex items-center relative text-sm focus:text-green-500 cursor-pointer focus:outline-none transition duration-200 ease-in-out opacity-0 mx-0.5   text-gray-600  " title="code excerpt" type="button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" fill="currentColor" focusable="false" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 32 32"><path d="M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z" transform="translate(0)"></path><path d="M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z" transform="translate(0)"></path><rect fill="none" width="32" height="32"></rect></svg><!----> <div class=" absolute pointer-events-none transition-opacity bg-black text-white py-1 px-2 leading-tight rounded font-normal shadow left-1/2 top-full transform -translate-x-1/2 translate-y-2 opacity-0 "><div class="absolute bottom-full left-1/2 transform -translate-x-1/2 w-0 h-0 border-black border-4 border-t-0" style="border-left-color: transparent; border-right-color: transparent;"></div> Copied</div><!----></button><!----></div> <pre class="language-python "><!---->activation = get_kernel(<span class="hljs-string">&quot;someorg/activation&quot;</span>, version=<span class="hljs-number">1</span>)<!----></pre></div><!----> <p>will raise an exception unless <code>someorg</code> is a trusted publisher.</p> <p>Pass <code>trust_remote_code=True</code> to allow any publisher, or pass a list of repo IDs
to allow only those repos (plus trusted publishers). The default is <code>False</code> to
always block unknown publishers.</p> <div class="code-block relative "><div class="absolute top-2.5 right-4"><button class="inline-flex items-center relative text-sm focus:text-green-500 cursor-pointer focus:outline-none transition duration-200 ease-in-out opacity-0 mx-0.5   text-gray-600  " title="code excerpt" type="button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" fill="currentColor" focusable="false" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 32 32"><path d="M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z" transform="translate(0)"></path><path d="M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z" transform="translate(0)"></path><rect fill="none" width="32" height="32"></rect></svg><!----> <div class=" absolute pointer-events-none transition-opacity bg-black text-white py-1 px-2 leading-tight rounded font-normal shadow left-1/2 top-full transform -translate-x-1/2 translate-y-2 opacity-0 "><div class="absolute bottom-full left-1/2 transform -translate-x-1/2 w-0 h-0 border-black border-4 border-t-0" style="border-left-color: transparent; border-right-color: transparent;"></div> Copied</div><!----></button><!----></div> <pre class="language-python "><!---->activation = get_kernel(
    <span class="hljs-string">&quot;someorg/activation&quot;</span>,
    version=<span class="hljs-number">1</span>,
    trust_remote_code=[<span class="hljs-string">&quot;someorg/activation&quot;</span>]
)<!----></pre></div><!----> <p>If your library loads kernels on behalf of its users, expose a flag so they can
control untrusted publishers. For example:</p> <div class="code-block relative "><div class="absolute top-2.5 right-4"><button class="inline-flex items-center relative text-sm focus:text-green-500 cursor-pointer focus:outline-none transition duration-200 ease-in-out opacity-0 mx-0.5   text-gray-600  " title="code excerpt" type="button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" fill="currentColor" focusable="false" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 32 32"><path d="M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z" transform="translate(0)"></path><path d="M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z" transform="translate(0)"></path><rect fill="none" width="32" height="32"></rect></svg><!----> <div class=" absolute pointer-events-none transition-opacity bg-black text-white py-1 px-2 leading-tight rounded font-normal shadow left-1/2 top-full transform -translate-x-1/2 translate-y-2 opacity-0 "><div class="absolute bottom-full left-1/2 transform -translate-x-1/2 w-0 h-0 border-black border-4 border-t-0" style="border-left-color: transparent; border-right-color: transparent;"></div> Copied</div><!----></button><!----></div> <pre class="language-python "><!---->TRUST_REMOTE_KERNELS = os.environ.get(<span class="hljs-string">&quot;MYLIB_TRUST_REMOTE_KERNELS&quot;</span>, <span class="hljs-string">&quot;0&quot;</span>) == <span class="hljs-string">&quot;1&quot;</span>

activation = get_kernel(
    <span class="hljs-string">&quot;someorg/activation&quot;</span>,
    version=<span class="hljs-number">1</span>,
    trust_remote_code=[<span class="hljs-string">&quot;someorg/activation&quot;</span>] <span class="hljs-keyword">if</span> TRUST_REMOTE_KERNELS <span class="hljs-keyword">else</span> <span class="hljs-literal">False</span>
)<!----></pre></div><!----> <!--[2--><h3 class="relative group"><a id="kernels-community" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#kernels-community"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>kernels-community</span></h3><!--]--><!----> <p>The <a href="https://huggingface.co/kernels-community/kernels" rel="nofollow">kernels-community</a> organization provides a large number of kernels that are maintained by Hugging
Face. Kernels from this organization are publicly maintained through <a href="https://github.com/huggingface/kernels-community" rel="nofollow">GitHub</a> and are built using
ephemeral build containers. PRs that are merged into kernels-community go
through an automated security audit and can only be merged by a very small group
of maintainers.</p> <p>The kernels-community organization is a trusted publisher, so it provides good
kernel coverage out of the box.</p> <!--[2--><h3 class="relative group"><a id="kernel-provenance" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#kernel-provenance"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Kernel provenance</span></h3><!--]--><!----> <p>You can also check that a build came from the claimed source. Every kernel built
with kernel-builder records provenance in the build variant’s <code>metadata.json</code>,
including the Git commits of:</p> <ul><li>The revision of kernel-builder that the kernel was built with.</li> <li>The revision of the kernel source itself.</li></ul> <p>This information is stored in the build variant’s <code>metadata.json</code>. For example:</p> <div class="code-block relative "><div class="absolute top-2.5 right-4"><button class="inline-flex items-center relative text-sm focus:text-green-500 cursor-pointer focus:outline-none transition duration-200 ease-in-out opacity-0 mx-0.5   text-gray-600  " title="code excerpt" type="button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" fill="currentColor" focusable="false" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 32 32"><path d="M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z" transform="translate(0)"></path><path d="M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z" transform="translate(0)"></path><rect fill="none" width="32" height="32"></rect></svg><!----> <div class=" absolute pointer-events-none transition-opacity bg-black text-white py-1 px-2 leading-tight rounded font-normal shadow left-1/2 top-full transform -translate-x-1/2 translate-y-2 opacity-0 "><div class="absolute bottom-full left-1/2 transform -translate-x-1/2 w-0 h-0 border-black border-4 border-t-0" style="border-left-color: transparent; border-right-color: transparent;"></div> Copied</div><!----></button><!----></div> <pre class="language-json "><!----><span class="hljs-attr">&quot;provenance&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
  <span class="hljs-attr">&quot;kernel-builder&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
    <span class="hljs-attr">&quot;version&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;0.17.0-dev0&quot;</span><span class="hljs-punctuation">,</span>
    <span class="hljs-attr">&quot;commit&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;a7f0afdb29a6a3372b1d47180cc0c182454c5e3b&quot;</span><span class="hljs-punctuation">,</span>
    <span class="hljs-attr">&quot;dirty&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span>
  <span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span>
  <span class="hljs-attr">&quot;kernel&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
    <span class="hljs-attr">&quot;commit&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;a137a8498a30a98631a3deedfa44ea01bf1cef7c&quot;</span><span class="hljs-punctuation">,</span>
    <span class="hljs-attr">&quot;dirty&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">false</span></span>
  <span class="hljs-punctuation">}</span>
<span class="hljs-punctuation">}</span><!----></pre></div><!----> <p>For a full example, see the <a href="https://huggingface.co/kernels/kernels-community/flash-attn3/blob/v2/build/torch-stable-abi29-cu126-x86_64-linux/metadata.json" rel="nofollow">flash-attn3 kernel</a>.</p> <p>This provenance information can be used to rebuild the kernel at the exact same
revisions of the kernel and the builder. A binary diff between the remote build
and your local build can help reveal any tampering.</p> <p>Kernel builds are largely reproducible because kernels are built using Nix
inside a sandbox. <code>kernel-builder</code> pins the full toolchain (compiler, C library,
etc.) in <code>flake.lock</code>. You can find these pins in the <a href="https://github.com/huggingface/kernels" rel="nofollow">kernels</a> repository.</p> <!--[1--><h2 class="relative group"><a id="kernel-compromises" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#kernel-compromises"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Kernel compromises</span></h2><!--]--><!----> <p>Even if you trust a kernel developer, their credentials might be compromised. An
attacker could use the credentials to upload a malicious version of a kernel. <code>kernels</code> offers two protections against these attack vectors:</p> <ul><li>Kernel locking</li> <li>Code signing</li></ul> <!--[2--><h3 class="relative group"><a id="kernel-locking" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#kernel-locking"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Kernel locking</span></h3><!--]--><!----> <p>Kernel locking records the Git commit hash of a kernel in a <code>kernels.lock</code> file.
After the kernel is locked, load it with <code>get_locked_kernel</code> (downloads if
needed) or <code>load_kernel</code> (requires a pre-downloaded kernel and errors if it is
missing). Either path only loads the locked commit. If an attacker compromises a
kernel Hub repository and pushes a new, malicious version, it will not be used.
See <a href="./locking">Lock kernel versions</a> for how to lock the kernels of a
project.</p> <p>An attacker can circumvent the lock by trying to craft a commit that collides
with the SHA-1 hash. However, this is currently hard, since the Hugging Face Hub
platform uses a Git implementation with SHA-1 collision detection
(<a href="https://github.com/cr-marcstevens/sha1collisiondetection" rel="nofollow">sha1dc</a>).</p> <!--[2--><h3 class="relative group"><a id="code-signing" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#code-signing"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Code signing</span></h3><!--]--><!----> <p><code>kernels</code> can verify kernels with cosign.</p> <p>On load, <code>kernels</code> checks that the files match signed digests in <code>metadata.json</code>. Signing uses cosign with short-lived keys, and the signature is
recorded in a <a href="https://docs.sigstore.dev/logging/overview/" rel="nofollow">ledger</a>. That
combination makes leaked CI signing keys much harder to reuse.</p> <p>The builder computes the SHA-256 digest of each file in the kernel and stores it
in <code>metadata.json</code>:</p> <div class="code-block relative "><div class="absolute top-2.5 right-4"><button class="inline-flex items-center relative text-sm focus:text-green-500 cursor-pointer focus:outline-none transition duration-200 ease-in-out opacity-0 mx-0.5   text-gray-600  " title="code excerpt" type="button"><svg xmlns="http://www.w3.org/2000/svg" aria-hidden="true" fill="currentColor" focusable="false" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 32 32"><path d="M28,10V28H10V10H28m0-2H10a2,2,0,0,0-2,2V28a2,2,0,0,0,2,2H28a2,2,0,0,0,2-2V10a2,2,0,0,0-2-2Z" transform="translate(0)"></path><path d="M4,18H2V4A2,2,0,0,1,4,2H18V4H4Z" transform="translate(0)"></path><rect fill="none" width="32" height="32"></rect></svg><!----> <div class=" absolute pointer-events-none transition-opacity bg-black text-white py-1 px-2 leading-tight rounded font-normal shadow left-1/2 top-full transform -translate-x-1/2 translate-y-2 opacity-0 "><div class="absolute bottom-full left-1/2 transform -translate-x-1/2 w-0 h-0 border-black border-4 border-t-0" style="border-left-color: transparent; border-right-color: transparent;"></div> Copied</div><!----></button><!----></div> <pre class="language-json "><!----><span class="hljs-attr">&quot;digest&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
  <span class="hljs-attr">&quot;algorithm&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;sha256&quot;</span><span class="hljs-punctuation">,</span>
  <span class="hljs-attr">&quot;files&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span>
    <span class="hljs-attr">&quot;__init__.py&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;iY6XPtdZUgS8HizpndYTF+U/5kUmeLsADwCNM0UXMME=&quot;</span><span class="hljs-punctuation">,</span>
    <span class="hljs-attr">&quot;_ops.py&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;5ecEPtZkkJLggvzM/luMYUmHIpCZXiBMEwXG0GmIMBU=&quot;</span><span class="hljs-punctuation">,</span>
    <span class="hljs-attr">&quot;_rmsnorm_xpu_89d4054.abi3.so&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;yb8gSiUShkgjnrdDNTPJ0prhLPQAvTIFWwbllgqK5po=&quot;</span><span class="hljs-punctuation">,</span>
    <span class="hljs-attr">&quot;layers.py&quot;</span><span class="hljs-punctuation">:</span> <span class="hljs-string">&quot;8KMmxy30Olm/16XW7vvHAwWNVWcnA8js0nNuoOSGEO8=&quot;</span>
  <span class="hljs-punctuation">}</span>
<span class="hljs-punctuation">}</span><!----></pre></div><!----> <p>Aside from the main signature, cosign also records information about how the
signature was made, such as the OIDC issuer, the source repository, and the
workflow path/branch.</p> <p>Signature verification performs the following steps:</p> <ul><li>Verify the signature against the given policy. The default policy only accepts
kernels signed by workflows in the <code>huggingface/kernels-community</code> GitHub
repository.</li> <li>Verify the authenticity of <code>metadata.json</code> using the signature.</li> <li>Use the digests in <code>metadata.json</code> to verify the kernel files.</li></ul> <p>At this time, a signature verification error will only result in a warning.
Moreover, signature verification is only performed when the <code>sigstore</code> Python
package is installed. However, we will make signature verification mandatory in
the future.</p> <p>The same steps can be performed on demand with the <a href="cli-verify-signature"><code>kernels verify-signature</code></a> command.</p> <!--[3--><h4 class="relative group"><a id="signature-verification-receipts" class="header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full" href="#signature-verification-receipts"><span><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 256"><path d="M167.594 88.393a8.001 8.001 0 0 1 0 11.314l-67.882 67.882a8 8 0 1 1-11.314-11.315l67.882-67.881a8.003 8.003 0 0 1 11.314 0zm-28.287 84.86l-28.284 28.284a40 40 0 0 1-56.567-56.567l28.284-28.284a8 8 0 0 0-11.315-11.315l-28.284 28.284a56 56 0 0 0 79.196 79.197l28.285-28.285a8 8 0 1 0-11.315-11.314zM212.852 43.14a56.002 56.002 0 0 0-79.196 0l-28.284 28.284a8 8 0 1 0 11.314 11.314l28.284-28.284a40 40 0 0 1 56.568 56.567l-28.285 28.285a8 8 0 0 0 11.315 11.314l28.284-28.284a56.065 56.065 0 0 0 0-79.196z" fill="currentColor"></path></svg><!----></span></a> <span>Signature verification receipts</span></h4><!--]--><!----> <p>To avoid the high cost of signature verification, a kernel is only verified in
full once. The first time a kernel is loaded, we perform all the steps above.
Upon successful verification, we write a receipt file to the kernels cache.</p> <p>When a receipt is found on a later load, the signature and digest checks are
skipped. The signing certificate is still checked against the policy, since the
receipt could have been written by a verification with a different policy.</p> <p>Receipts are stored by kernel identity. The name of a receipt file is a hash of:</p> <ul><li>The repo ID</li> <li>The Git commit hash</li> <li>The build variant</li></ul> <p>This means that downloading a different revision or build variant of the same
kernel will not collide with the existing receipt and will be verified as
expected.</p> <a class="!text-gray-400 !no-underline text-sm flex items-center not-prose mt-4" href="https://github.com/huggingface/kernels/blob/main/docs/source/security.md" target="_blank"><svg class="mr-1" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" fill="currentColor" focusable="false" role="img" width="1em" height="1em" preserveAspectRatio="xMidYMid meet" viewBox="0 0 32 32"><path d="M31,16l-7,7l-1.41-1.41L28.17,16l-5.58-5.59L24,9l7,7z"></path><path d="M1,16l7-7l1.41,1.41L3.83,16l5.58,5.59L8,23l-7-7z"></path><path d="M12.419,25.484L17.639,6.552l1.932,0.518L14.351,26.002z"></path></svg><!----> <span><span class="underline">Update</span> on GitHub</span></a><!----> <p></p><!--]--><!----><!--]--><!--]--><!--]--> <!--[-1--><!--]--><!--]-->
			
			<script>
				{
					__sveltekit_bxmh2q = {
						base: "/docs/kernels/main/en",
						assets: "/docs/kernels/main/en"
					};
					const element = document.currentScript.parentElement;
					Promise.all([
						import("/docs/kernels/main/en/_app/immutable/entry/start.BJAz11b3.js"),
						import("/docs/kernels/main/en/_app/immutable/entry/app.DtzmdH2K.js")
					]).then(([kit, app]) => {
						kit.start(app, element, {
							node_ids: [0, 38],
							data: [null,null],
							form: null,
							error: null
						});
					});
				}
			</script>
		
Xet Storage Details

Size:: 34.6 kB
Xet hash:: 69b0c83b1ae15f801cec2b052ed252f4fc93e52dafe4db5ebd7b4cc0df8f4f42
Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.