Studio: match offline weight-index filenames case-insensitively

The index-name check compared the on-disk filename exactly, while the
surrounding weight and safetensors matches use case-insensitive rules. On a
case-insensitive volume (Windows or macOS) from_pretrained opens an oddly-cased
cache file such as PYTORCH_MODEL.BIN.INDEX.JSON when it requests the canonical
lowercase name, so the exact-case check skipped it and a nested pickle shard it
referenced was allowed through. Lower-case the index name before matching, as
the rest of the gate does, and add a regression test.

Author: shimmyshimmer

studio/backend/tests/test_offline_embedding_minimal.py

@@ -460,6 +460,27 @@ def test_gate_blocks_indexed_shard_with_no_pickle_extension(hf_cache):
     assert any(u["path"] == "shards/payload" for u in decision.unsafe_files)
 
 
+def test_gate_blocks_uppercase_index_filename(hf_cache):
+    # On case-insensitive volumes (Windows/macOS) from_pretrained opens an oddly-cased index when it
+    # requests the canonical lowercase name, so the index-name match must be case-insensitive too.
+    _make_cache(
+        hf_cache,
+        "org/upper-index",
+        {
+            "PYTORCH_MODEL.BIN.INDEX.JSON": (
+                '{"weight_map": {"w": "shards/pytorch_model-00001-of-00001.bin"}}'
+            ),
+            "shards/pytorch_model-00001-of-00001.bin": "pickle",
+        },
+    )
+    with _no_network():
+        decision = _offline_decision("org/upper-index")
+    assert decision.blocked is True
+    assert any(
+        u["path"] == "shards/pytorch_model-00001-of-00001.bin" for u in decision.unsafe_files
+    )
+
+
 def test_gate_blocks_indexed_pickle_shard_in_module_subdir(hf_cache):
     # A weight index inside a sentence-transformers module load root points at a nested pickle shard.
     _make_cache(

studio/backend/utils/security/file_security.py

@@ -390,9 +390,12 @@ def _add(path: Path):
         # torch.loads any not ending in .safetensors. A base safetensors makes it skip the pytorch
         # index; a safetensors index is itself chosen, so its non-safetensors targets always load.
         for index_path in entries:
-            if index_path.name not in _TORCH_INDEX_FILES:
+            # Case-insensitive like the weight/safetensors matches above: a case-insensitive volume
+            # (Windows/macOS) opens an oddly-cased index when the loader asks for the canonical name.
+            name = index_path.name.lower()
+            if name not in _TORCH_INDEX_FILES:
                 continue
-            if index_path.name == "pytorch_model.bin.index.json" and has_base_safetensors:
+            if name == "pytorch_model.bin.index.json" and has_base_safetensors:
                 continue
             for shard_path in _indexed_pickle_shards(index_path, root, snapshot):
                 _add(shard_path)