OpenSSF project
OpenSSF Model Signing (OMS)
A library and CLI for cryptographically signing and verifying machine learning models of any format or size, supporting multiple PKI backends including Sigstore, self-signed certificates, and bare key pairs.
How each persona uses OpenSSF Model Signing (OMS)
Software Developer / Maintainer Developer
Signs the ML models they publish so downstream users can confirm a model came from them and has not been altered.
Security Engineer / Architect Security
Verifies model signatures before deployment to keep tampered or untrusted model weights out of production systems.
CI/CD DevOps & Tooling Integrator DevOps
Adds keyless model signing and verification as pipeline steps, mirroring the artifact-signing controls already used for code.
Package & Repository Manager Package Manager
Surfaces and verifies model signatures so a model registry can prove the provenance of the weights it serves.
Problems OpenSSF Model Signing (OMS) helps with
Artefact Signing & Verification Signing
Extends identity-based signing and verification to ML models of any format, so consumers can confirm who produced the weights.
Build & Provenance Integrity Build Integrity
Attaches verifiable signatures to model artifacts, letting downstream users trace a model back to its origin.