[Bug]: vllm 0.4.1 broke pip 517 compatability

[GRcharles]

🐛 Describe the bug

vllm now attempts to download a package from github on pip install https://github.com/vllm-project/vllm-nccl/releases/download/v0.1.0/cu12-libnccl.so.2.18.1

This breaks pip 517 compatability.

When I install this in an environment without access to the wider internet (but with a pypi proxy), I get the following error

Downloading nccl package from https://github.com/vllm-project/vllm-nccl/releases/download/v0.1.0/cu12-libnccl.so.2.18.1
  Failed to download nccl package from https://github.com/vllm-project/vllm-nccl/releases/download/v0.1.0/cu12-libnccl.so.2.18.1
  <urlopen error [Errno -3] Temporary failure in name resolution>
...
Note: This error originates from the build backend, and is likely not a problem with poetry but with vllm-nccl-cu12 (2.18.1.0.3.0) not supporting PEP 517 builds. You can verify this by running 'pip wheel --no-cache-dir --use-pep517 "vllm-nccl-cu12 (==2.18.1.0.3.0)"'.

[youkaichao]

Please download it yourself, and use VLLM_NCCL_SO_PATH to point to the path. We have no choice before pypi/support#3792 .

[CharlesFauman]

this feels more deserving of a public discussion, for such a widely used open source repo

you can more easily hide malicious code in a github release than pypi. and you, a contributor with just 3 weeks of history contributing to this repo, have sole control over that distribution.

this situation feels quite sketchy.

[zhuohan123]

@CharlesFauman Kaichao is a visiting student at UC Berkeley and a new member of the vLLM team. We talk and meet in person every week here at Berkeley. We asked @youkaichao to help us debug the long-lasting NCCL bugs in vLLM and we found out that it is caused by one specific new version of NCCL. Originally we would like to include NCCL in our wheel, but the pypi wheel size limit prevents us from doing this. We eventually have to ship nccl in another pypi package to get around this size limit.

If you don't like this new dependency (actually we don't like this dependency as well), please comment this issue to help us get a pypi limit increase.