How It Works
OpenSSF Model Signing provides a framework for cryptographically verifying the integrity and provenance of machine learning models at load time. It achieves this through two primary mechanisms: Sigstore keyless signing and conventional key-based signing. Sigstore leverages an append-only transparency log to record signing events, ensuring that all signatures are publicly verifiable and tamper-evident. This approach eliminates the need for manual key management while maintaining strong cryptographic guarantees.
When a model is signed, the process generates a Sigstore bundle in JSON format, which encapsulates the verification material and the model payload within a DSSE envelope. This envelope includes an in-toto statement that binds the model’s file paths and cryptographic digests to a predicate type, specifically https://modelsigning/signature/v1.0. The signature is computed over this statement, ensuring that any alteration to the model or its metadata will invalidate the signature. The bundle also includes a proof of inclusion from Sigstore’s transparency log, allowing verifiers to confirm that the signature was recorded and has not been tampered with.
Verification involves reading the Sigstore bundle and performing two critical checks: validating the cryptographic signature and recomputing the model’s file hashes to confirm they match the signed digests. This dual-step process ensures that the model has not been altered since signing and that the signature originates from a trusted identity. If the verification passes, users can confidently trust that the model’s integrity and provenance are intact.
The system supports multiple signing methods, including Sigstore’s keyless workflow, traditional public-key cryptography, and PKCS #11-enabled hardware security modules. Each method accommodates different use cases, from automated CI/CD pipelines to high-security environments requiring hardware-backed cryptographic operations.
Sigstore’s transparency log plays a pivotal role in the ecosystem. Signers can monitor the log for unauthorized or unexpected signing events, while verifiers can audit the log to ensure that the models they are using have been properly recorded. This transparency extends beyond individual signatures, providing a tamper-proof audit trail of all signing activities. The log is particularly valuable for detecting supply chain attacks, where malicious actors might attempt to distribute compromised models under the guise of legitimate updates.
This digest is then signed using the chosen method, producing a signature file that can be distributed alongside the model. During verification, the same digest computation is performed, and the results are compared against the signed digests. Any discrepancy triggers a verification failure, alerting users to potential tampering or corruption.
For organizations using private Sigstore instances, the library supports custom configurations via a clienttrustconfig.json file. This file specifies trust roots, signing endpoints, and public keys, enabling enterprises to deploy their own Sigstore infrastructure for internal use. This capability is particularly useful for regulated industries or environments where external transparency logs may not be permissible. The configuration also allows for fine-grained control over identity providers, supporting OAuth-based authentication with platforms like Google, GitHub, Microsoft, and GitLab CI.
The library’s design emphasizes interoperability and extensibility. It adheres to open standards such as DSSE and in-toto, ensuring compatibility with existing tooling in the software supply chain security space. The inclusion of predicates in the in-toto statement also future-proofs the specification, allowing for the incorporation of additional metadata such as model cards or compliance artifacts.
OpenTelemetry support is integrated as an optional feature, enabling distributed tracing and observability for signing and verification operations.
The library is implemented in Python and distributed under the Apache 2.0 license, ensuring broad adoption and compatibility with existing Python-based ML workflows. It is designed to be used both as a standalone CLI tool and as a programmatic library, accommodating a wide range of deployment scenarios. The CLI provides subcommands for signing and verification, with additional flags to customize behavior, such as specifying signature names, locations, and signing methods.
Use Cases
OpenSSF Model Signing addresses critical gaps in the machine learning supply chain by providing verifiable claims about model integrity and provenance. One primary use case is securing the distribution of pre-trained models, where users can independently verify that a model has not been altered since its release. By signing models at the point of release, organizations can ensure that downstream users receive the intended model without unauthorized modifications.
OpenSSF Model Signing provides a standardized mechanism for generating and verifying cryptographic proofs of model authenticity, aligning with frameworks like NIST’s supply chain security guidelines. The ability to monitor Sigstore’s transparency log further enhances compliance by enabling continuous auditing of signing activities.
This approach mitigates the risk of deploying compromised models due to supply chain attacks or insider threats. The library’s support for identity providers like GitHub Actions and Google Cloud Platform simplifies integration with existing CI/CD systems, reducing friction for organizations adopting model signing.
By signing models with verifiable identities, researchers can attest to the reproducibility and integrity of their work. The transparency log ensures that all signing events are publicly auditable, fostering accountability and reducing the risk of misinformation or malicious contributions.
Hardware security modules (HSMs) and PKCS #11 devices are supported for environments requiring the highest levels of cryptographic assurance.
Model signing also plays a role in detecting and mitigating supply chain attacks. By verifying signatures at load time, organizations can detect anomalies such as unexpected signing events or mismatched digests. The transparency log enables proactive monitoring, allowing security teams to investigate suspicious activities before they result in breaches. This proactive approach is essential for maintaining resilience against evolving threats in the AI supply chain.
For organizations deploying models in edge or embedded systems, cryptographic verification ensures that only trusted models are executed. These environments often lack the resources for comprehensive runtime monitoring, making pre-deployment verification a critical safeguard. OpenSSF Model Signing provides a lightweight mechanism for validating model integrity before deployment, reducing the attack surface and minimizing the risk of exploits targeting untrusted or corrupted models. The minimal Docker container variant further optimizes resource usage for constrained environments.
Key Features & Capabilities
The default method uses Sigstore’s keyless signing workflow, which eliminates the need for manual key management by leveraging short-lived certificates issued via OAuth-based identity providers. Users can authenticate using providers such as Google, GitHub, Microsoft, or GitLab CI, ensuring compatibility with existing identity management systems.
Traditional public-key cryptography is also supported, allowing users to sign models with private keys and verify them using corresponding public keys. This method is suitable for environments where Sigstore’s keyless workflow is not feasible, such as air-gapped systems or highly customized security architectures. The library provides utilities for key generation and management, including support for PKCS #11 devices, which enable hardware-backed cryptographic operations. This flexibility ensures that organizations can choose the signing method that best fits their security posture.
The Sigstore bundle format is central to the library’s functionality. It encapsulates the model payload, cryptographic signatures, and verification metadata in a structured JSON format. The bundle includes a DSSE envelope containing an in-toto statement, which binds the model’s file paths and digests to a predicate. This design ensures that the signature is computed over the entire model artifact, including its metadata, providing end-to-end integrity protection. The inclusion of a proof of inclusion from Sigstore’s transparency log further enhances trust by enabling verifiers to confirm the authenticity of the signature.
Verification is a two-step process that combines cryptographic validation with digest comparison. The library first verifies the digital signature to ensure it was generated by a trusted entity. It then recomputes the hashes of the model files and compares them against the signed digests. This dual-check mechanism guarantees that the model has not been altered since signing and that the signature corresponds to the intended payload.
Sigstore’s transparency log is a critical component of the ecosystem, providing an immutable record of all signing events. The log is append-only, meaning that once a signature is recorded, it cannot be altered or deleted. Verifiers can use the log to obtain a proof of inclusion, confirming that a given signature exists and has not been tampered with. Signers can monitor the log for unauthorized or unexpected signing events, enabling proactive threat detection and response.
The clienttrustconfig.json file enables users to specify custom endpoints for Rekor (the transparency log) and Fulcio (the certificate authority), as well as public keys for verification. This flexibility ensures that organizations can maintain full control over their cryptographic infrastructure while benefiting from the security guarantees provided by Sigstore.
The CLI provides subcommands for signing and verification, with additional flags to configure parameters such as signature names, locations, and signing methods. Users can sign models using Sigstore, private keys, or certificates, and verify them with corresponding public keys or identity providers. The API offers programmatic access to the same functionality, enabling integration with custom workflows or automation scripts.
Recent releases have expanded the library’s capabilities, including support for PKCS #11 devices, private Sigstore instances, and enhanced error handling. Version 1.1.0 introduced breaking changes due to an upgrade to sigstore-4.0.0, but no breaking changes were introduced in the model-signing library itself. This release also added support for more hashing algorithms, improved customization options, and a minimal Docker container variant that excludes optional dependencies to reduce footprint.
The library’s support for legacy signatures ensures backward compatibility with models signed using earlier versions of the tool.
Error handling has been improved to provide more informative feedback during verification.