Google's Open Source Security Team announced version 1.0 of the model-signing project in a Sigstore blog post on 4 April 2025. The team says it built the package over the previous year with the Open Source Security Foundation (OpenSSF), NVIDIA and HiddenLayer, on top of the sigstore-python library.[1] On the same day, OpenSSF announced the release as a project of its AI/ML working group.[2] The GitHub release notes describe 1.0 as the first stable release, with a backward-compatible programming interface, a command-line tool and a defined signature scheme.[3]
The library can sign with public keys and certificates or with Sigstore. The project describes Sigstore as a way to make code signatures transparent without managing cryptographic keys.[4] The post recommends Sigstore as the default. In that workflow, signing obtains a short-lived certificate bound to the OpenID Connect identity of the developer or workload. OpenID Connect is a standard sign-in protocol. The signature and certificate are then recorded in Sigstore's transparency log, a public record of signing events. According to the post, the log helps monitor signing events so that a rogue insider cannot release models as if the company had signed them. The post adds that model hubs and users can verify a model after its certificate expires, because the certificate and a proof of inclusion in the log are uploaded with the model.[1]
The signature is stored as a Sigstore bundle whose signed statement lists the model's files with their hashes. Verification checks the signature and then recomputes the file hashes.[4] The team designed the library to be built into model hubs such as Kaggle and Hugging Face, which could verify signatures at upload. It was also designed to be built into frameworks such as PyTorch, where saving a model could sign it.[1] OpenSSF's announcement says signatures should be checked when a model is uploaded to a hub, selected for deployment or used as input to another model.[2]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
86eab4920b0f187d8274c97fa7b805da011028cbc1eab25225c93c4224b5d665
