Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch cpu-inference workflow from --extra-index-url to --index-url #5182

Merged
merged 1 commit into from Feb 23, 2024

Conversation

loadams
Copy link
Contributor

@loadams loadams commented Feb 23, 2024

This switch should cause no impact to the workflow, but ensures that we only download this package from the correct feed rather than defaulting/falling back to the index-url default (PyPI) for if a package existed with a higher version there that would be chosen instead.

@loadams
Copy link
Contributor Author

loadams commented Feb 23, 2024

@delock - can you or your team register the oneccl_bind_pt package name on PyPI so that if others have this vulnerability they will be protected from malicious actors as well?

@loadams loadams merged commit afdf028 into master Feb 23, 2024
13 checks passed
@loadams loadams deleted the loadams/update-intel-index-url branch February 23, 2024 22:15
@delock
Copy link
Contributor

delock commented Feb 24, 2024

@loadams thanks for the suggestion. I'll check with the team on this potential vulerability.

ShellyNR pushed a commit to ShellyNR/DeepSpeed that referenced this pull request Mar 11, 2024
…icrosoft#5182)

This switch should cause no impact to the workflow, but ensures that we
only download this package from the correct feed rather than
defaulting/falling back to the index-url
[default](https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-i)
(PyPI) for if a package existed with a higher version there that would
be chosen instead.
rraminen pushed a commit to ROCm/DeepSpeed that referenced this pull request May 9, 2024
…icrosoft#5182)

This switch should cause no impact to the workflow, but ensures that we
only download this package from the correct feed rather than
defaulting/falling back to the index-url
[default](https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-i)
(PyPI) for if a package existed with a higher version there that would
be chosen instead.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants