AI Governance Engineer
GitHub

Model signing

By Updated

Signing a model's files at build: a manifest lists every file with its cryptographic digest and a detached signature covers the manifest, so any changed file fails verification. The OpenSSF Model Signing specification uses the Sigstore bundle format and supports keyless signing, private PKI, self-signed certificates or bare keys 1. Serving verifies the signature before it loads a model.

Developed in
ch. 14, Reproducibility and linked versioning
ch. 05, Pattern: Model Artefact Integrity
Chapters
ch. 05, Patterns · ch. 14, Development · ch. 15, Deployment
Contrast with
Build provenance (SLSA)
Source
1 numbered reference, listed below

Where it is used

The term is not used under this name in running prose; the sections listed under "Developed in" treat it.

Patterns that use this term

One pattern page uses the term.

Model signing: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern02 InventoryModel signingRelated terms (1)Safetensors · RelatedSafetensorsContrast with (1)Build provenance (SLSA) · ContrastBuild provenance (SLSA)Patterns using it (1)Model Artefact Integrity, 1 mention · Uses the termModel Artefact Integrity
Model signing: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern02 InventoryRelated terms (1)Safetensors · RelatedSafetensorsPatterns using it (1)Model Artefact Integrity, 1 mention · Uses the termModel Artefact IntegrityContrast with (1)Build provenance (SLSA) · ContrastBuild provenance (SLSA)Model signing
The term's neighbourhood Terms related to this one on solid edges, terms it is often confused with on dashed edges, and the patterns that use it most in the colour of their layer. Follow a dashed edge to check the distinction before you use either term.
Neighbourhood as a table
Neighbourhood of Model signing
FamilyItemRelation
Related termsSafetensorsRelated
Contrast withBuild provenance (SLSA)Contrast
Patterns using itModel Artefact Integrity, 1 mentionUses the term
  • Safetensors

    A file format for storing a model's tensors safely, as opposed to Python pickle, whose loading can run arbitrary code and which the Python documentation calls…

Sources

  1. [1] "An Introduction to the OpenSSF Model Signing (OMS) Specification" (detached signature over a manifest of file hashes; Sigstore bundle format; PKI-agnostic: private PKI, self-signed certificates, bare keys, keyless Sigstore). OpenSSF. 2025-06-25. https://openssf.org/blog/2025/06/25/an-introduction-to-the-openssf-model-signing-oms-specification/ (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Model signing. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/model-signing. CC BY 4.0

BibTeX

@misc{aige2026modelsigning,
  author  = {Jorge García Aibar},
  title   = {{Model signing}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/model-signing}
}