fix: extend digest verification to sha512 and set sandbox paths

[ericcurtin]

Extend blob digest verification to cover sha512 in addition to sha256, closing a bypass where sha512-addressed blobs were stored without any integrity check. Set correct SandboxPath for Python backends (diffusers, mlx, vllm-metal) so the Darwin sandbox profile resolves UPDATEDLIBPATH to the sibling lib/ directory of the Python bin/ directory.

[sourcery-ai]

Hey - I've left some high level feedback:

• In WriteBlobWithResume, when diffID.Algorithm is neither sha256 nor sha512 the blob is now written without any integrity check; consider explicitly rejecting unsupported algorithms (or at least logging) instead of silently skipping verification.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `WriteBlobWithResume`, when `diffID.Algorithm` is neither `sha256` nor `sha512` the blob is now written without any integrity check; consider explicitly rejecting unsupported algorithms (or at least logging) instead of silently skipping verification.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request introduces support for SHA-512 hashing in the blob store and updates the sandbox path configuration for several inference backends (Diffusers, MLX, and vLLM Metal) to ensure correct directory scoping. I have no feedback to provide.

[ilopezluna]

ilopezluna@F2D5QD4D6C model-runner % docker model uninstall-runner --backend vllm     
Uninstalled vllm backend
ilopezluna@F2D5QD4D6C model-runner % docker model install-runner --backend vllm     
Installing vllm backend...
vllm backend installed successfully
ilopezluna@F2D5QD4D6C model-runner % docker model run smollm2-vllm                    
> hello
background model preload failed: preload failed: status=500 body=unable to load runner: error waiting for runner to be ready: vllm-metal terminated unexpectedly: vllm-metal failed: (APIServer pid=92759)     self.input_socket = self.resources.input_socket = make_zmq_socket(
(APIServer pid=92759)                                                       ^^^^^^^^^^^^^^^^
(APIServer pid=92759)   File "/Users/ilopezluna/.docker/model-runner/vllm-metal/lib/python3.12/site-packages/vllm/utils/network_utils.py", line 309, in make_zmq_socket
(APIServer pid=92759)     socket.bind(path)
(APIServer pid=92759)   File "/Users/ilopezluna/.docker/model-runner/vllm-metal/lib/python3.12/site-packages/zmq/sugar/socket.py", line 320, in bind
(APIServer pid=92759)     super().bind(addr)
(APIServer pid=92759)   File "zmq/backend/cython/_zmq.py", line 1009, in zmq.backend.cython._zmq.Socket.bind
(APIServer pid=92759)   File "zmq/backend/cython/_zmq.py", line 190, in zmq.backend.cython._zmq._check_rc
(APIServer pid=92759) zmq.error.ZMQError: Operation not permitted (addr='ipc:///var/folders/xy/2ylpqbs55c7233trwq3lpscm0000gp/T/eca66bed-bc55-41af-9950-e93de87ab5e0')
/v1/engine/core_client.py", line 562, in __init__


Failed to generate a response: error response: status=500 body=unable to load runner: error waiting for runner to be ready: vllm-metal terminated unexpectedly: vllm-metal failed: (APIServer pid=96473)     self.input_socket = self.resources.input_socket = make_zmq_socket(
(APIServer pid=96473)                                                       ^^^^^^^^^^^^^^^^
(APIServer pid=96473)   File "/Users/ilopezluna/.docker/model-runner/vllm-metal/lib/python3.12/site-packages/vllm/utils/network_utils.py", line 309, in make_zmq_socket
(APIServer pid=96473)     socket.bind(path)
(APIServer pid=96473)   File "/Users/ilopezluna/.docker/model-runner/vllm-metal/lib/python3.12/site-packages/zmq/sugar/socket.py", line 320, in bind
(APIServer pid=96473)     super().bind(addr)
(APIServer pid=96473)   File "zmq/backend/cython/_zmq.py", line 1009, in zmq.backend.cython._zmq.Socket.bind
(APIServer pid=96473)   File "zmq/backend/cython/_zmq.py", line 190, in zmq.backend.cython._zmq._check_rc
(APIServer pid=96473) zmq.error.ZMQError: Operation not permitted (addr='ipc:///var/folders/xy/2ylpqbs55c7233trwq3lpscm0000gp/T/53f30cd8-f4af-4372-812a-2ae34c103c08')
/v1/engine/core_client.py", line 562, in __init__

I get this error in vllm-metal

I have realized it fails when using vllm-metal

[sathiraumesh]

Just a suggestion, It may be better to move this to a separate function like

hasher(string algo) (has.Hash){
...
}