Ollama Verified Corrupt Model Files as Valid, Wasting Two Days of Debugging

·1 views

A developer running AI agent frameworks in a hardened VM spent two days troubleshooting recurring system hangs and a broken model, tracing errors through Python frameworks and HTTP libraries before finding the real cause. Ollama, a local model-serving tool, was falsely reporting successful installations of model files that were actually filled with null bytes due to interrupted writes. The tool's content-addressed storage system names each file after its own SHA256 hash, but Ollama skips re-hashing files that already exist at the expected path, silently trusting corrupt data. A single manual sha256sum command immediately revealed the mismatch between a file's name and its actual contents — a check the tool claimed to perform but did not. The developer found two corrupted files out of thirteen in the store, and confirmed the flaw deliberately by zeroing a file and watching Ollama count it as valid on restart.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Kubernetes Shifts from Ingress to Gateway API: What Engineers Need to Know

The Kubernetes ecosystem is moving away from the traditional Ingress API toward the newer Gateway API, marking a significant change in how traffic routing and load balancing are managed. The Ingress API's rigid, monolithic design struggles to support multi-cluster and multi-tenant environments, while the Gateway API introduces a modular architecture with components like Gateways, HTTPRoutes, and TCPRoutes. However, the transition poses real challenges, including configuration complexity and a lack of mature documentation and tooling. Organizations that delay migration risk missing out on advanced capabilities such as traffic mirroring and canary deployments. Community collaboration and open-source contributions are seen as key to bridging the knowledge gap and accelerating adoption.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to build an embedded Shopify app in PHP Symfony without official docs

A developer has published a detailed technical guide on building an embedded Shopify app using Symfony 7.4 and PHP 8.5, based on a real app called StockPilot that passed Shopify's review process. Because Shopify's official documentation primarily supports Node.js, PHP developers have lacked a clear reference for implementing the platform's authentication model. The guide explains how embedded apps run inside admin.shopify.com as cross-origin iframes, making traditional PHP sessions unusable and requiring JWT-based session tokens issued by Shopify's App Bridge instead. It covers key security steps including HMAC signature verification, audience and domain claim validation, and a deliberate clock-skew leeway to prevent false token expiry errors. The article also details the OAuth token exchange flow that converts a session token into an offline access token needed to make authenticated Shopify API calls.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why LLM Apps Need Inline Validation Built In From Day One

A developer building an AI-powered app called Slooster learned the hard way that traditional software testing methods fail when large language models are involved, as LLMs can produce inconsistent or nonsensical outputs even from identical prompts. During a staging demo, prompts that had reliably returned real vendor data for weeks suddenly produced placeholder text like 'Vendor A' and 'Vendor B.' To address this, the developer built an inline validation layer with automatic retries that catches bad outputs before users see them. The system uses two layers of checks: a structural schema validator and a secondary AI prompt that evaluates whether the output is semantically meaningful and meets the original criteria. The key lesson is that validation must be continuous, configurable, and built into the application from the start, not treated as an afterthought.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why GitHub Actions workflows should pin dependencies by SHA, not tags

Git tags used in GitHub Actions workflows are mutable pointers that repository owners can silently redirect to different code at any time, posing a supply-chain security risk. Pinning an action to a specific commit SHA ensures the exact audited code runs every time, regardless of upstream changes. Developers should resolve each SHA themselves using the GitHub API rather than copying values from third-party sources, to establish genuine verification. Adding a version comment alongside the SHA, such as '# v4', allows tools like Dependabot to continue offering update pull requests, preventing pinned references from quietly going stale. For actions published on rolling branches, SHA pinning still applies, but teams must actively monitor and bump those references when upstream fixes are released.

0 comments Read more at DEV Community