[beveradb]

Summary

• Mirror first. Every model file is now fetched from this repo's model-configs release first, with the original source as fallback (UVR's TRvlvr/model_repo, or Meta's CDN for Demucs). Before this, the UVR repo was tried first even though we host identical copies, so about half the models, including karaoke-gen's default RoFormer models, always came from a third-party repo. VIP models still come from Anjok07's repo first.
• SHA-256 verification. New audio_separator/model-checksums.json lists all 243 published model files, which covers all 273 file references in the supported-model list. A download that doesn't match is discarded and the next source is tried. Cached files are checked once per process (cached by path, size and mtime) and re-downloaded if they don't match. Files with no published checksum are still accepted, so newly added UVR models keep working until the manifest is regenerated. Mutable metadata lists such as download_checks.json are never checked.
• Atomic downloads. Downloads go to <file>.<pid>.partial and are renamed only after they pass verification. Before this, an interrupted download left a truncated file that every later run treated as present.
• Maintenance. tools/update-model-checksums.py regenerates the manifest after new uploads. It only hashes files it doesn't already have, unless --rehash is passed.
• README: new "Where Models Are Downloaded From" section. Version bumped to 0.48.0.

Follow-up to #316 (GHSA-4g2m-m2pr-7g4g): with this, a compromised upstream can't swap in a different file at all, malicious or just corrupted.

How the manifest was built

Every asset in all three release repos (331) plus the 7 Demucs files on Meta's CDN was streamed and hashed on the build host, about 108 GB in total.

• Every byte count matches GitHub's listed asset size.
• The 89 filenames published in more than one place are byte-identical everywhere, so the fallback sources verify against the same hashes.
• The Demucs hashes match the checksums embedded in their filenames.

Testing

• New tests/unit/test_model_download_integrity.py covers source order (mirror / upstream / VIP / MDXC yaml), tampered downloads falling through to the next source, all sources tampered, tampered cached files being replaced, verified cached files not being re-hashed, files without a checksum, metadata not being checked, and the bundled manifest covering the default models.
• Unit suite: 571 passed. The 2 test_mps_native_fp16 failures also happen on main.
• Real download of UVR-MDX-NET-Inst_HQ_4.onnx: fetched from the mirror and verified. Re-verifying it in a new process took 0.03 s. After appending a byte, it was detected and re-downloaded.
• Built the wheel and confirmed it contains model-checksums.json.
• Local CodeRabbit, 2 cycles. Fixed: per-process partial path, retries in the checksum tool. Skipped: keeping a failed-checksum file around, since it would be refused anyway.

@coderabbitai ignore

🤖 Generated with Claude Code

https://claude.ai/code/session_012RYLVTA9CYSnmncNv3GRHJ