hf2q 0.1.7

Pure Rust CLI for converting HuggingFace models to hardware-optimized formats and serving them over an OpenAI-compatible API on Apple Silicon
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

#[path = "floors.rs"]
mod floors;
#[path = "hostile_profile.rs"]
mod hostile_profile;
#[path = "rotation.rs"]
mod rotation;

use super::{
    authorization, commit_at_recorded_completion, complete_static_transcript, instant, request,
    ROOT,
};
use crate::distribution::install_state::metadata::read_selected;
use crate::distribution::update_auth::model::{
    EmbeddedTrustRoot, MetadataResponse, VerificationStep, MAX_ROOT_ROTATIONS,
};
use crate::distribution::update_auth::replay::begin_from_selected_for_test;
use crate::distribution::update_auth::test_repository::{
    anchor_at_version, hostile_root_profile_cases, multi_rotation, online_binding_change_cases,
    online_key_rotation_recovery, same_key_chain, same_key_chain_with_expiry, same_key_lower_roles,
    static_lower_roles, successive_threshold_rotations, targets_key_rotation_with_lower_rollback,
    threshold_rotation, transient_online_rotation_with_lower_rollback,
    unrelated_root_rotation_with_lower_rollback, RepositoryFixture, RotationSignatures,
};
use crate::distribution::update_auth::verifier::begin_from_anchor_for_test;
use crate::distribution::update_auth::verifier::RoleFloor;
use crate::distribution::update_auth::{profile, strict_json, TufVerifierError};

fn leaked_anchor(bytes: &[u8]) -> EmbeddedTrustRoot {
    EmbeddedTrustRoot::from_compiled(Box::leak(bytes.to_vec().into_boxed_slice()))
}

pub(super) fn complete_fixture(
    mut step: VerificationStep,
    fixture: &RepositoryFixture,
    already_trusted_roots: usize,
) -> crate::distribution::update_auth::VerifiedMetadataCandidate {
    for (index, root) in fixture.roots.iter().enumerate().skip(already_trusted_roots) {
        let expected = format!("{}.root.json", index + 2);
        step = request(step, &expected)
            .respond(MetadataResponse::Found(root.clone().into_boxed_slice()))
            .expect("gapless root authenticates");
    }
    let terminal = format!("{}.root.json", fixture.roots.len() + 2);
    step = request(step, &terminal)
        .respond(MetadataResponse::ConfirmedNotFound)
        .expect("only explicit root not-found terminates the chain");
    step = request(step, "timestamp.json")
        .respond(MetadataResponse::Found(
            fixture.timestamp.clone().into_boxed_slice(),
        ))
        .expect("timestamp authenticates");
    let snapshot_name = if fixture.consistent_snapshot {
        format!("{}.snapshot.json", fixture.metadata_version)
    } else {
        "snapshot.json".to_owned()
    };
    step = request(step, &snapshot_name)
        .respond(MetadataResponse::Found(
            fixture.snapshot.clone().into_boxed_slice(),
        ))
        .expect("snapshot authenticates");
    let targets_name = if fixture.consistent_snapshot {
        format!("{}.targets.json", fixture.metadata_version)
    } else {
        "targets.json".to_owned()
    };
    step = request(step, &targets_name)
        .respond(MetadataResponse::Found(
            fixture.targets.clone().into_boxed_slice(),
        ))
        .expect("targets authenticate");
    match step {
        VerificationStep::Candidate(candidate) => candidate,
        VerificationStep::Request(_) => panic!("complete repository requested another role"),
    }
}