Skip to content

[Infra] Harden supply chain: remove unused scripts, add pip binary-only install #25023

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yuneng-berri merged 1 commit into from
Apr 2, 2026
+2 −61
Merged

[Infra] Harden supply chain: remove unused scripts, add pip binary-only install #25023

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 0 additions & 40 deletions .pre-commit-config.yaml
View file
Open in desktop

This file was deleted.

19 changes: 0 additions & 19 deletions ci_cd/publish-proxy-extras.sh
View file
Open in desktop

This file was deleted.

4 changes: 2 additions & 2 deletions scripts/install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,8 @@ echo ""
header "Installing litellm[proxy]…"
echo ""

"$PYTHON_BIN" -m pip install --upgrade "${LITELLM_PACKAGE}" \
|| die "pip install failed. Try manually: $PYTHON_BIN -m pip install '${LITELLM_PACKAGE}'"
"$PYTHON_BIN" -m pip install --only-binary :all: --upgrade "${LITELLM_PACKAGE}" \
|| die "pip install failed. Try manually: $PYTHON_BIN -m pip install --only-binary :all: '${LITELLM_PACKAGE}'"
Comment on lines +86 to +87

@greptile-apps greptile-apps Bot Apr 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 --only-binary :all: blocks install on wheel-less platforms; fallback error points to the same failing command

--only-binary :all: tells pip to refuse to build any package from source, including transitive dependencies. While litellm itself publishes wheels, some of its heavier dependencies (e.g., cryptography, grpcio, or any native-extension package) may ship sdist-only for certain platforms — most notably musl-based Linux (Alpine / Docker slim images), unusual CPU architectures (ARM32, RISC-V, s390x), or older Python patch versions that don't yet have pre-built wheels.

When pip hits even a single sdist-only dependency it aborts the entire install with an error like:

ERROR: Could not find a version that satisfies the requirement <pkg> (from litellm)
NOTE: This error originates from a subprocess, and is likely not a problem with pip.

The more pressing problem is the updated die() message:

die "pip install failed. Try manually: $PYTHON_BIN -m pip install --only-binary :all: '${LITELLM_PACKAGE}'"

The manual command it suggests carries the same --only-binary :all: flag, so on a platform that lacks wheels it will fail again — leaving the user with no viable recovery path. The original error message (without --only-binary) would have actually worked as a fallback.

Consider either:

  1. Falling back to a non-binary install only on failure (two-step), or
  2. Keeping --only-binary :all: but fixing the error message to omit the flag so the user can self-recover:
Suggested change
"$PYTHON_BIN" -m pip install --only-binary :all: --upgrade "${LITELLM_PACKAGE}" \
|| die "pip install failed. Try manually: $PYTHON_BIN -m pip install --only-binary :all: '${LITELLM_PACKAGE}'"
"$PYTHON_BIN" -m pip install --only-binary :all: --upgrade "${LITELLM_PACKAGE}" \
|| die "pip install failed. Try manually: $PYTHON_BIN -m pip install '${LITELLM_PACKAGE}'"


# ── find the litellm binary installed by pip for this Python ───────────────
# sysconfig.get_path('scripts') is where pip puts console scripts — reliable
Expand Down
Loading