Skip to content

CHANGELOG.md

Latest commit

 

History

History
92 lines (71 loc) · 7.82 KB

CHANGELOG.md

File metadata and controls

92 lines (71 loc) · 7.82 KB
Raw

Changelog

All notable changes to model-signing will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

All versions prior to 1.0.0 are untracked.

Unreleased

Added

  • Added the digest subcommand to compute and print a model's digest. This enables other tools to easily pair the attestations with a model directory.
  • Added --module-paths option to PKCS #11 signing methods pkcs11-key and pkcs11-certificate.

Changed

  • Standardized CLI flags to use hyphens (e.g., --trust-config instead of --trust_config). Underscore variants are still accepted for backwards compatibility via token normalization.

Fixed

  • Fixed a bug where installing from the sdist produced an empty wheel with zero Python modules. The hatch packages directive was scoped to all build targets instead of the wheel target only, causing the sdist's flattened layout to not match the expected src/ path. (#636)
  • Fixed a bug where ignored symlinks could raise ValueErrors if allow_symlinks was unset, even though they were skipped during serialization. (#550)
  • Fixed a bug where any PEM encoded key could be read during the key-based flows which resulted in a Python exception because the rest of the code only supported elliptic curve keys. (#573)

Removed

1.1.1 - 2025-10-10

Fixed

  • Fixed a bug where the API with default signing configuration results in an error due to a type confusion (#545)

1.1.0 - 2025-10-10

Added

  • Added support for signing with PKCS #11 devices (#411), as an optional dependency (#494).
  • Added support for signing and verifying using private Sigstore instances via the --trust_config option (#460).
  • Added support for the --oauth_force_oob option for the signing CLI flow (#471).
  • Added support for specifying --client_id and --client_secret for OIDC authentication with custom OAuth clients (#475).
  • Surfaced the --allow_symlinks option to the CLI and library API (#486).
  • Implemented public key identifier hash matching for bundle verification (#493).
  • Added warning for older verification material formats (e.g., raw public key bytes) during verification, recommending re-signing (#493).
  • Added more informative signature mismatch errors: The ValueError raised during model verification when a signature mismatch occurs now includes detailed information about what caused the signature verification to fail (#495).
  • Created a new, minimal container image. This variant excludes optional dependencies (like OTel and PKCS#11) to reduce footprint, focusing solely on core signing and verification mechanisms (#499).
  • Added support for --ignore_unsigned_files option in CLI to ignore files that are not part of the manifest but are still present in the model directory (#501).
  • Added support to trace sign and verify operations using OpenTelemetry (#503).
  • The library was migrated to require at least v4.0.0 of sigstore due to breaking changes in that library (#532). There are no breaking changes within the library itself, as these changes should be transparent to the users.
  • The sigstore_protobuf_specs dependency was replaced with sigstore_models due to the same changes in sigstore-4.0.0 (#533). These changes should also be transparent to the users.
  • Added support for BLAKE3 hashing (#538).

Changed

  • Adjusted model name when signing and verifying when model_path is current directory (#452).
  • Recorded files in signature that were ignored when signature was created and added ability to automatically ignore those files when verifying signature (#462).
  • The Sigstore signer was changed to be lazily initialized to avoid network calls when not using it (#467).
  • Logging was migrated to only be enabled when the user asks to log the certificate fingerprints (#472).

Fixed

  • Fixed bugs related to using model_path='.' in the signature, as well as other issues related to file paths (#452).
  • Fixed handling of certificate that has no KeyUsage (#457).
  • Fixed bug related to ignoring git files (#462).
  • Fixed handling of ignored files in the sharded file hasher (#465).
  • Fixed handling of path resulting from certificates returned from certify API (#468).
  • Fixed deserialization bug related to optional values in protobuf API for keyid (#490).

1.0.1 - 2025-04-18

Added

  • Added support for pre v1.0 signatures used in production. This is only provided for verification and replicates the experimental behavior at v0.2, bug for bug.
  • Added support for displaying fingerprints of certificates when using signing certificates

Fixed

  • Fix bug in CLI scripts where even if signature verification failed, the script would also output that verification passed and exit with success error code.
  • Docker containers wrapping around the CLI have been changed to support the updated CLI

1.0.0 - 2025-04-04

Added

  • First stable release of model_signing.
  • Stable, backwards-compatible API.
  • Stable, clean, backwards-compatible CLI wrapping the API.
  • Well-defined signature scheme based on Sigstore bundle and DSSE envelope.
  • Well-defined, future proof, stable, in-toto format for the model signature.
  • Signing and verification using Sigstore, public/private key pairs, and signing certificates.
  • Support for signing/verification via scripts in the repo (hatch run python -m model_signing), installing the pip package (python -m model_signing or model_signing), or Docker containers that wrap around the CLI.
  • Support for Python 3.9, 3.10, 3.11, 3.12, and 3.13.
  • Demo notebook to showcase API and CLI examples.