From 56a0d46196c01b3123aac4f72c4aca6b7bb60bb3 Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Wed, 21 Oct 2026 16:20:31 +0530 Subject: [PATCH] fix(examples): declare model-signing OpenSSL dependency Signed-off-by: Srinivasa Dinakar Jainti --- .github/workflows/examples-ci.yml | 3 ++- examples/weight-custody-manifest/README.md | 6 +++--- examples/weight-custody-manifest/requirements-lora.txt | 1 + .../weight-custody-manifest/requirements-model-signing.txt | 4 ++++ examples/weight-custody-manifest/requirements.txt | 2 +- 5 files changed, 11 insertions(+), 5 deletions(-) create mode 100644 examples/weight-custody-manifest/requirements-model-signing.txt diff --git a/.github/workflows/examples-ci.yml b/.github/workflows/examples-ci.yml index 310e6f14..50000c3e 100644 --- a/.github/workflows/examples-ci.yml +++ b/.github/workflows/examples-ci.yml @@ -249,7 +249,8 @@ jobs: # from PyPI, which is what makes them a check on the release. run: | python -m pip install --require-hashes -r ../requirements/wcm-harness.txt - python -m pip install "weight-custody-manifest[model-signing]>=0.27.0" + python -m pip install -r requirements-model-signing.txt + python -m pip check - name: Run every offline demo and the unit tests run: python run_demos.py diff --git a/examples/weight-custody-manifest/README.md b/examples/weight-custody-manifest/README.md index 05e87a4a..d8213e8b 100644 --- a/examples/weight-custody-manifest/README.md +++ b/examples/weight-custody-manifest/README.md @@ -15,7 +15,7 @@ For a public open-weight model, base-weight confidentiality is theater (anyone c ```bash git clone https://github.com/agentrust-io/integrations.git cd integrations/examples/weight-custody-manifest -pip install -r requirements.txt # weight-custody-manifest>=0.21.0, Python 3.11+ +pip install -r requirements.txt # weight-custody-manifest>=0.32.0, Python 3.11+ ``` The offline demos need nothing else. `real_open_model.py` needs run-local extras (below). @@ -67,7 +67,7 @@ The same machinery, two trust settings. **Closed** weights (a frontier model dep - **`transparency_log.py`** -- the append-only Merkle log (SPEC 3.7 / RFC 9162): inclusion and consistency proofs, and a monitor detecting a suppressed revocation. - **`post_quantum.py`** -- sign and verify a manifest with ML-DSA-65 and with the Ed25519+ML-DSA-65 hybrid profile. -- **`provenance_model_signing.py`** -- interop with OpenSSF model-signing: a WCM manifest references a model-signing signature as its provenance, and `verify_provenance` cryptographically verifies it. Needs the extra: `pip install "weight-custody-manifest[model-signing]"`. +- **`provenance_model_signing.py`** -- interop with OpenSSF model-signing: a WCM manifest references a model-signing signature as its provenance, and `verify_provenance` cryptographically verifies it. Needs the extra: `pip install -r requirements-model-signing.txt`. ### Verifying real attestations @@ -81,7 +81,7 @@ The same machinery, two trust settings. **Closed** weights (a frontier model dep ```bash python closed_model_e2e.py # any of the offline examples -pip install "weight-custody-manifest[model-signing]" # for provenance_model_signing.py +pip install -r requirements-model-signing.txt # for provenance_model_signing.py pip install -r requirements-infer.txt # for real_open_model.py python real_open_model.py ``` diff --git a/examples/weight-custody-manifest/requirements-lora.txt b/examples/weight-custody-manifest/requirements-lora.txt index ed115d01..ce11f3e0 100644 --- a/examples/weight-custody-manifest/requirements-lora.txt +++ b/examples/weight-custody-manifest/requirements-lora.txt @@ -4,4 +4,5 @@ transformers==5.19.0 peft==0.21.2 accelerate==1.15.0 torch==2.14.1 +-r requirements-model-signing.txt model-signing==1.1.1 diff --git a/examples/weight-custody-manifest/requirements-model-signing.txt b/examples/weight-custody-manifest/requirements-model-signing.txt new file mode 100644 index 00000000..48de0a62 --- /dev/null +++ b/examples/weight-custody-manifest/requirements-model-signing.txt @@ -0,0 +1,4 @@ +-r requirements.txt +weight-custody-manifest[model-signing]>=0.32.0 +# model-signing 1.1.1 imports OpenSSL directly; sigstore no longer supplies it. +pyOpenSSL>=26.4.0 diff --git a/examples/weight-custody-manifest/requirements.txt b/examples/weight-custody-manifest/requirements.txt index ee29129e..b0a39fee 100644 --- a/examples/weight-custody-manifest/requirements.txt +++ b/examples/weight-custody-manifest/requirements.txt @@ -1,4 +1,4 @@ # The Weight Custody Manifest reference SDK, from PyPI. # Covers the offline examples. provenance_model_signing.py additionally needs the -# [model-signing] extra: pip install "weight-custody-manifest[model-signing]". +# optional dependencies: pip install -r requirements-model-signing.txt. weight-custody-manifest>=0.32.0