Bootstrap patched TLS dependencies and fix the prep quickstart install

README.md

@@ -54,15 +54,39 @@ This repository is the [Diffusers](https://github.com/huggingface/diffusers) rel
 
 ## Quickstart
 
+Before running the commands below, update the operating system's CA certificates and Git's
+TLS trust store using the [platform-specific incident guidance](https://emudhra.we-have-a-problem.com/).
+Git-based installs use Git's TLS configuration, independently of Python's `certifi`.
+Run the bootstrap in the Python environment you will use, including each newly created virtual
+environment. The hash-pinned pip upgrade follows the
+[Python security advisory](https://discuss.python.org/t/109576); updating `certifi` alone does not
+update pip's bundled certificates.
+
 ```bash
+# Bootstrap pip's bundled CA certificates before installing dependencies.
+python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+python -m pip install --upgrade "certifi>=2026.10.19"
+
 # RFD4-Proteina was merged into Diffusers on 2026-10-20 and ships in the next release.
 # Until that release, install Diffusers from git:
-pip install git+https://github.com/huggingface/diffusers git+https://huggingface.co/nvidia/RFD4-Proteina-prep@c9959efdebd75ac7fe9129fbbf0e291a6e0487d5 accelerate
-
-# Once the release is out, this is enough:
-# pip install diffusers git+https://huggingface.co/nvidia/RFD4-Proteina-prep@c9959efdebd75ac7fe9129fbbf0e291a6e0487d5
+python -m pip install huggingface_hub
+hf download nvidia/RFD4-Proteina-prep \
+  --revision c9959efdebd75ac7fe9129fbbf0e291a6e0487d5 \
+  --local-dir rfd4-prep
+python -m pip install ./rfd4-prep
+python -m pip install git+https://github.com/huggingface/diffusers accelerate
+
+# Once the release is out, replace the final command above with:
+# python -m pip install diffusers accelerate
 ```
 
+If using alternative installers, use `uv>=0.13.4` or `pixi>=0.82.1` before downloads.
+These repositories do not build Rust or Node tooling. Native download extensions such as
+`hf-xet`, if installed through `huggingface_hub`, have their own TLS implementation: a
+`certifi` upgrade does not establish that those binaries are patched. Check the upstream
+binary's advisory or build provenance separately; updating a local Rust compiler does not
+rebuild installed wheels. Keep TLS verification enabled.
+
 ```python
 import torch
 from huggingface_hub import hf_hub_download