Require patched certifi and bootstrap pip before prep installation

README.md

@@ -22,17 +22,36 @@ dependency on the original RFD4 runtime.
 
 ## Install and authenticate
 
+Before running the commands below, update the operating system's CA certificates and Git's
+TLS trust store using the [platform-specific incident guidance](https://emudhra.we-have-a-problem.com/).
+Git-based installs use Git's TLS configuration, independently of Python's `certifi`.
+Run the bootstrap in the Python environment you will use, including each newly created virtual
+environment. The hash-pinned pip upgrade follows the
+[Python security advisory](https://discuss.python.org/t/109576); updating `certifi` alone does not
+update pip's bundled certificates.
+
 Python 3.11 or newer is required. The repository and the model are public, so no authentication is needed for the downloads below; log in only if you hit rate limits, and keep tokens out of notebooks and shell history.
 
 ```bash
-pip install huggingface_hub
+# Bootstrap pip's bundled CA certificates before installing dependencies.
+python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
+python -m pip install --upgrade "certifi>=2026.10.19"
+
+python -m pip install huggingface_hub
 hf auth login
 hf auth whoami
 hf download nvidia/RFD4-Proteina-prep --local-dir rfd4-prep
-pip install ./rfd4-prep
-pip install git+https://github.com/huggingface/diffusers
+python -m pip install ./rfd4-prep
+python -m pip install git+https://github.com/huggingface/diffusers
 ```
 
+If using alternative installers, use `uv>=0.13.4` or `pixi>=0.82.1` before downloads.
+These repositories do not build Rust or Node tooling. Native download extensions such as
+`hf-xet`, if installed through `huggingface_hub`, have their own TLS implementation: a
+`certifi` upgrade does not establish that those binaries are patched. Check the upstream
+binary's advisory or build provenance separately; updating a local Rust compiler does not
+rebuild installed wheels. Keep TLS verification enabled.
+
 `RFD4ProteinaPipeline` was merged into Diffusers on 2026-10-20 ([huggingface/diffusers#15088](https://github.com/huggingface/diffusers/pull/15088)) and ships in the next release, so install Diffusers from GitHub until then. The model revision below is the one whose parameter names and shapes match that code. Older model revisions, including `b21bec64`, use different parameter names and do not load. The helper does
 not convert weights or silently repair compatibility. `trust_remote_code=True` loads Python from the helper repo;
 inspect `block.py` and pin a revision for reproducible use. It does not install dependencies automatically.
@@ -206,7 +225,7 @@ training batches. The design tasks it samples from live in `_cif/transforms_desi
 dependency:
 
 ```bash
-pip install 'rfd4-proteina-prep[train]'
+python -m pip install 'rfd4-proteina-prep[train]'
 ```
 
 Inference never imports those modules, so a plain install is unchanged by their presence. What this package does *not*

pyproject.toml

@@ -8,7 +8,7 @@ version = "0.1.0"
 description = "Annotated-CIF input preparation and output export for the Diffusers RFD4-Proteina pipeline."
 requires-python = ">=3.11"
 license = { text = "BSD-3-Clause" }
-dependencies = ["torch", "numpy", "atomworks[ml]==3.0.4", "scipy", "jaxtyping"]
+dependencies = ["torch", "numpy", "atomworks[ml]==3.0.4", "scipy", "jaxtyping", "certifi>=2026.10.19"]
 
 [project.urls]
 Homepage = "https://huggingface.co/nvidia/RFD4-Proteina-prep"