Skip to content

Commit 351c7f9

Browse files
Yadan-WeiYadan Wei
Yadan-Wei
and
Yadan Wei
authored
Onboard PT2.6 Training to Autopatch (#4645)
* run efa * add core packages * build ec2 autopatch * build * build sm * enable security tests * add os allowlist * inject libfreetype6 tp ecr vuls * add two more os allowlist * build ec2 * revert toml --------- Co-authored-by: Yadan Wei <yadanwei@amazon.com>
1 parent fc1d89a commit 351c7f9

11 files changed

+388
-4
lines changed

‎pytorch/training/buildspec-2-5-ec2.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ images:
4242
os_version: &OS_VERSION ubuntu22.04
4343
tag: !join [ *VERSION, "-", *DEVICE_TYPE, "-", *TAG_PYTHON_VERSION, "-", *OS_VERSION, "-ec2" ]
4444
latest_release_tag: !join [ *VERSION, "-", *DEVICE_TYPE, "-", *TAG_PYTHON_VERSION, "-", *OS_VERSION, "-ec2" ]
45-
# build_tag_override: "beta:2.5.0-cpu-py311-ubuntu22.04-ec2"
45+
# build_tag_override: "beta:2.5.1-cpu-py311-ubuntu22.04-ec2"
4646
docker_file: !join [ docker/, *SHORT_VERSION, /, *DOCKER_PYTHON_VERSION, /Dockerfile., *DEVICE_TYPE ]
4747
target: ec2
4848
context:
@@ -58,7 +58,7 @@ images:
5858
os_version: &OS_VERSION ubuntu22.04
5959
tag: !join [ *VERSION, "-", *DEVICE_TYPE, "-", *TAG_PYTHON_VERSION, "-", *CUDA_VERSION, "-", *OS_VERSION, "-ec2" ]
6060
latest_release_tag: !join [ *VERSION, "-", *DEVICE_TYPE, "-", *TAG_PYTHON_VERSION, "-", *CUDA_VERSION, "-", *OS_VERSION, "-ec2" ]
61-
# build_tag_override: "beta:2.5.0-gpu-py311-cu121-ubuntu22.04-ec2"
61+
# build_tag_override: "beta:2.5.1-gpu-py311-cu121-ubuntu22.04-ec2"
6262
docker_file: !join [ docker/, *SHORT_VERSION, /, *DOCKER_PYTHON_VERSION, /, *CUDA_VERSION, /Dockerfile.,
6363
*DEVICE_TYPE ]
6464
target: ec2

‎pytorch/training/buildspec-2-6-ec2.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ framework: &FRAMEWORK pytorch
55
version: &VERSION 2.6.0
66
short_version: &SHORT_VERSION "2.6"
77
arch_type: x86
8-
# autopatch_build: "True"
8+
autopatch_build: "True"
99

1010
repository_info:
1111
training_repository: &TRAINING_REPOSITORY

‎pytorch/training/buildspec-2-6-sm.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ framework: &FRAMEWORK pytorch
55
version: &VERSION 2.6.0
66
short_version: &SHORT_VERSION "2.6"
77
arch_type: x86
8-
# autopatch_build: "True"
8+
autopatch_build: "True"
99

1010
repository_info:
1111
training_repository: &TRAINING_REPOSITORY

‎pytorch/training/docker/2.6/py3/Dockerfile.ec2.cpu.core_packages.json‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{
2+
"accelerate": {
3+
"version_specifier": "==1.4.0",
4+
"skip": "True"
5+
},
6+
"s3torchconnector": {
7+
"version_specifier": "==1.3.2",
8+
"skip": "True"
9+
},
10+
"torchaudio": {
11+
"version_specifier": "==2.6.0+cpu",
12+
"skip": "True"
13+
},
14+
"torchtext": {
15+
"version_specifier": "==0.18.0+cpu",
16+
"skip": "True"
17+
},
18+
"torchdata": {
19+
"version_specifier": "==0.10.1+cpu",
20+
"skip": "True"
21+
},
22+
"torchtnt": {
23+
"version_specifier": "==0.2.4",
24+
"skip": "True"
25+
},
26+
"torchvision": {
27+
"version_specifier": "==0.21.0+cpu",
28+
"skip": "True"
29+
},
30+
"idna": {
31+
"version_specifier": ">=3.7"
32+
},
33+
"tqdm": {
34+
"version_specifier": ">=4.66.3"
35+
},
36+
"requests": {
37+
"version_specifier": ">=2.32.0"
38+
},
39+
"setuptools": {
40+
"version_specifier": ">=70.0.0"
41+
},
42+
"urllib3": {
43+
"version_specifier": "<2"
44+
},
45+
"awscli": {
46+
"version_specifier": "<2"
47+
}
48+
}

‎pytorch/training/docker/2.6/py3/Dockerfile.ec2.cpu.os_scan_allowlist.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"libfreetype6": [
3+
{
4+
"description": "An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.",
5+
"vulnerability_id": "CVE-2025-27363",
6+
"name": "CVE-2025-27363",
7+
"package_name": "libfreetype6",
8+
"package_details": {
9+
"file_path": null,
10+
"name": "libfreetype6",
11+
"package_manager": "OS",
12+
"version": "2.11.1+dfsg",
13+
"release": "1ubuntu0.2"
14+
},
15+
"remediation": { "recommendation": { "text": "None Provided" } },
16+
"cvss_v3_score": 8.1,
17+
"cvss_v30_score": 0.0,
18+
"cvss_v31_score": 8.1,
19+
"cvss_v2_score": 0.0,
20+
"cvss_v3_severity": "HIGH",
21+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-27363.html",
22+
"source": "UBUNTU_CVE",
23+
"severity": "HIGH",
24+
"status": "ACTIVE",
25+
"title": "CVE-2025-27363 - libfreetype6",
26+
"reason_to_ignore": "N/A"
27+
}
28+
]
29+
}

‎pytorch/training/docker/2.6/py3/Dockerfile.sagemaker.cpu.core_packages.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"accelerate": {
3+
"version_specifier": "==1.4.0",
4+
"skip": "True"
5+
},
6+
"s3torchconnector": {
7+
"version_specifier": "==1.3.2",
8+
"skip": "True"
9+
},
10+
"torchaudio": {
11+
"version_specifier": "==2.6.0+cpu",
12+
"skip": "True"
13+
},
14+
"torchtext": {
15+
"version_specifier": "==0.18.0+cpu",
16+
"skip": "True"
17+
},
18+
"torchdata": {
19+
"version_specifier": "==0.10.1+cpu",
20+
"skip": "True"
21+
},
22+
"torchtnt": {
23+
"version_specifier": "==0.2.4",
24+
"skip": "True"
25+
},
26+
"torchvision": {
27+
"version_specifier": "==0.21.0+cpu",
28+
"skip": "True"
29+
},
30+
"idna": {
31+
"version_specifier": ">=3.7"
32+
},
33+
"tqdm": {
34+
"version_specifier": ">=4.66.3"
35+
},
36+
"requests": {
37+
"version_specifier": ">=2.32.0"
38+
},
39+
"setuptools": {
40+
"version_specifier": ">=70.0.0"
41+
},
42+
"urllib3": {
43+
"version_specifier": "<2"
44+
},
45+
"awscli": {
46+
"version_specifier": "<2"
47+
},
48+
"sagemaker": {
49+
"version_specifier": ">=2,<3"
50+
},
51+
"sagemaker-experiments": {
52+
"version_specifier": "<1"
53+
},
54+
"cloudpickle": {
55+
"version_specifier": ">=2.2.1"
56+
}
57+
}

‎pytorch/training/docker/2.6/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"libfreetype6": [
3+
{
4+
"description": "An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.",
5+
"vulnerability_id": "CVE-2025-27363",
6+
"name": "CVE-2025-27363",
7+
"package_name": "libfreetype6",
8+
"package_details": {
9+
"file_path": null,
10+
"name": "libfreetype6",
11+
"package_manager": "OS",
12+
"version": "2.11.1+dfsg",
13+
"release": "1ubuntu0.2"
14+
},
15+
"remediation": { "recommendation": { "text": "None Provided" } },
16+
"cvss_v3_score": 8.1,
17+
"cvss_v30_score": 0.0,
18+
"cvss_v31_score": 8.1,
19+
"cvss_v2_score": 0.0,
20+
"cvss_v3_severity": "HIGH",
21+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-27363.html",
22+
"source": "UBUNTU_CVE",
23+
"severity": "HIGH",
24+
"status": "ACTIVE",
25+
"title": "CVE-2025-27363 - libfreetype6",
26+
"reason_to_ignore": "N/A"
27+
}
28+
]
29+
}

‎pytorch/training/docker/2.6/py3/cu126/Dockerfile.ec2.gpu.core_packages.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"accelerate": {
3+
"version_specifier": "==1.4.0",
4+
"skip": "True"
5+
},
6+
"flash-attn": {
7+
"version_specifier": "==2.7.3",
8+
"skip": "True"
9+
},
10+
"transformer-engine": {
11+
"version_specifier": "==2.0.0+e5cc6c2",
12+
"skip": "True"
13+
},
14+
"s3torchconnector": {
15+
"version_specifier": "==1.3.2",
16+
"skip": "True"
17+
},
18+
"torchaudio": {
19+
"version_specifier": "==2.6.0+cu126",
20+
"skip": "True"
21+
},
22+
"torchtext": {
23+
"version_specifier": "==0.18.0+cu126",
24+
"skip": "True"
25+
},
26+
"torchtnt": {
27+
"version_specifier": "==0.2.4",
28+
"skip": "True"
29+
},
30+
"torchvision": {
31+
"version_specifier": "==0.21.0+cu126",
32+
"skip": "True"
33+
},
34+
"idna": {
35+
"version_specifier": ">=3.7"
36+
},
37+
"tqdm": {
38+
"version_specifier": ">=4.66.3"
39+
},
40+
"requests": {
41+
"version_specifier": ">=2.32.0"
42+
},
43+
"setuptools": {
44+
"version_specifier": ">=70.0.0"
45+
},
46+
"urllib3": {
47+
"version_specifier": "<2"
48+
},
49+
"awscli": {
50+
"version_specifier": "<2"
51+
}
52+
}

‎pytorch/training/docker/2.6/py3/cu126/Dockerfile.ec2.gpu.os_scan_allowlist.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,58 @@
11
{
2+
"go/stdlib": [
3+
{
4+
"description": "The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.",
5+
"vulnerability_id": "CVE-2024-24790",
6+
"name": "CVE-2024-24790",
7+
"package_name": "go/stdlib",
8+
"package_details": {
9+
"file_path": "/opt/nvidia/nsight-systems/2024.5.1/target-linux-x64/plugins/efa_metrics/nic_sampler",
10+
"name": "go/stdlib",
11+
"package_manager": "GENERIC",
12+
"version": "1.22.3",
13+
"release": null
14+
},
15+
"remediation": { "recommendation": { "text": "None Provided" } },
16+
"cvss_v3_score": 9.8,
17+
"cvss_v30_score": 0.0,
18+
"cvss_v31_score": 9.8,
19+
"cvss_v2_score": 0.0,
20+
"cvss_v3_severity": "CRITICAL",
21+
"source_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24790",
22+
"source": "NVD",
23+
"severity": "CRITICAL",
24+
"status": "ACTIVE",
25+
"title": "CVE-2024-24790 - go/stdlib",
26+
"reason_to_ignore": "N/A"
27+
}
28+
],
29+
"libfreetype6": [
30+
{
31+
"description": "An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.",
32+
"vulnerability_id": "CVE-2025-27363",
33+
"name": "CVE-2025-27363",
34+
"package_name": "libfreetype6",
35+
"package_details": {
36+
"file_path": null,
37+
"name": "libfreetype6",
38+
"package_manager": "OS",
39+
"version": "2.11.1+dfsg",
40+
"release": "1ubuntu0.2"
41+
},
42+
"remediation": { "recommendation": { "text": "None Provided" } },
43+
"cvss_v3_score": 8.1,
44+
"cvss_v30_score": 0.0,
45+
"cvss_v31_score": 8.1,
46+
"cvss_v2_score": 0.0,
47+
"cvss_v3_severity": "HIGH",
48+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-27363.html",
49+
"source": "UBUNTU_CVE",
50+
"severity": "HIGH",
51+
"status": "ACTIVE",
52+
"title": "CVE-2025-27363 - libfreetype6",
53+
"reason_to_ignore": "N/A"
54+
}
55+
],
256
"org.apache.ant:ant": [
357
{
458
"description": "As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.",

‎pytorch/training/docker/2.6/py3/cu126/Dockerfile.sagemaker.gpu.core_packages.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"accelerate": {
3+
"version_specifier": "==1.4.0",
4+
"skip": "True"
5+
},
6+
"flash-attn": {
7+
"version_specifier": "==2.7.3",
8+
"skip": "True"
9+
},
10+
"transformer-engine": {
11+
"version_specifier": "==2.0.0+e5cc6c2",
12+
"skip": "True"
13+
},
14+
"s3torchconnector": {
15+
"version_specifier": "==1.3.2",
16+
"skip": "True"
17+
},
18+
"torchaudio": {
19+
"version_specifier": "==2.6.0+cu126",
20+
"skip": "True"
21+
},
22+
"torchtext": {
23+
"version_specifier": "==0.18.0+cu126",
24+
"skip": "True"
25+
},
26+
"torchtnt": {
27+
"version_specifier": "==0.2.4",
28+
"skip": "True"
29+
},
30+
"torchvision": {
31+
"version_specifier": "==0.21.0+cu126",
32+
"skip": "True"
33+
},
34+
"idna": {
35+
"version_specifier": ">=3.7"
36+
},
37+
"tqdm": {
38+
"version_specifier": ">=4.66.3"
39+
},
40+
"requests": {
41+
"version_specifier": ">=2.32.0"
42+
},
43+
"setuptools": {
44+
"version_specifier": ">=70.0.0"
45+
},
46+
"urllib3": {
47+
"version_specifier": "<2"
48+
},
49+
"awscli": {
50+
"version_specifier": "<2"
51+
},
52+
"sagemaker": {
53+
"version_specifier": ">=2,<3"
54+
},
55+
"sagemaker-experiments": {
56+
"version_specifier": "<1"
57+
},
58+
"cloudpickle": {
59+
"version_specifier": ">=2.2.1"
60+
}
61+
}

0 commit comments

Comments
 (0)