Hugging Face KernelsがネイティブコードをHubに導入 — コード署名でサプライチェーン攻撃を防げるのか
Hugging FaceはKernelsプロジェクトの大型アップデートをリリースし、新しいカーネルリポジトリタイプ、Trusted Publishers、Sigstoreコード署名を導入した。これによりAIカーネルの配布が標準化され、Pythonプロセスと同じ権限で実行されるネイティブコードの実行セキュリティが確保される。
hugging face released a major update for its kernels project, introducing a new 'kernel' repository type that makes custom compute kernels first-class citizens on the hub. the update enables users to filter kernels by supported accelerators, operating systems, and backend versions, addressing the need for standardized packaging of high-performance ai code. recognizing that kernels run native code with significant privileges, hugging face implemented a robust security framework requiring reproducible builds via nix, trusted publishers, and mandatory code signing using sigstore’s cosign to prevent supply chain compromises. the platform restricts kernel publishing permissions by default and requires users to explicitly opt-in via trust_remote_code to load kernels from unverified sources. these changes establish a more secure and discoverable ecosystem for distributing critical ai infrastructure components.