Sigstore

license

Apache-2.0(OSI)

source

public

core features withheld

no

The library and CLI are published under Apache-2.0 within the Sigstore project, an open-source effort of the OpenSSF, so no vendor stands behind it with a paid edition.

• https://raw.githubusercontent.com/sigstore/model-transparency/main/LICENSE recorded 2026-09-26

  Apache License, Version 2.0, full text

• https://raw.githubusercontent.com/sigstore/model-transparency/main/README.md recorded 2026-09-26

  "Building on the work with Open Source Security Foundation, we are creating this collection of projects to strengthen the ML supply chain"

• https://ungh.cc/repos/sigstore/model-transparency/files/main recorded 2026-09-26

  Full file listing of sigstore/model-transparency main, 198 paths; no ee/, enterprise/, commercial/ or proprietary/ directory

PyPI downloads of model-signing, the project's own package, measure its use. Signing done inside registries such as NVIDIA's NGC does not show up in them.

• https://pypistats.org/api/packages/model-signing/recent recorded 2026-09-26

  last_month downloads = 20,049 for model-signing

The signature lets anyone confirm a model is the one its publisher signed, without asking the publisher, and NVIDIA signs its NGC catalog to the same specification. It attests who published the weights, not how they were produced, which keeps it a step below NVIDIA's hardware attestation.

• https://developer.nvidia.com/blog/bringing-verifiable-trust-to-ai-models-model-signing-in-ngc recorded 2026-09-26

  "NVIDIA has been signing all NVIDIA-published models in the NGC Catalog with the OpenSSF Model Signing (OMS) specification since March 2025"; consumers verify with the OpenSSF Model Signing tooling and NVIDIA's public certificate

• https://raw.githubusercontent.com/ossf/model-signing-spec/main/README.md recorded 2026-09-26

  OpenSSF Model Signing (OMS) specification repository

• https://raw.githubusercontent.com/sigstore/model-transparency/main/README.md recorded 2026-09-26

  Aims at "verifiable claims about the integrity and provenance of the resulting models, meaning users can check for themselves"; signing creates a Sigstore bundle with a DSSE envelope