[noah-ing]

Summary

Fix the Examples / weight-custody-manifest job after dependency resolution drift. model-signing 1.1.1 imports OpenSSL.crypto but does not declare pyOpenSSL. The previous sigstore 4.5.0 resolution brought it in transitively; sigstore 4.5.1 does not. Add a shared, cryptography-50-compatible pyOpenSSL requirement and use it in CI, the WCM setup instructions, and the LoRA demo setup.

This is separate from the certifi update in #359; the WCM example failure reproduces on the unchanged base branch. Maintainer #362 is a narrower CI-only repair. If it lands first, this branch should be rebased to retain the shared requirements and documentation without duplicating its workflow change.

Validation and current blockers

• Reproduced ModuleNotFoundError: No module named OpenSSL in a clean Python 3.11 environment with the prior install sequence.
• Both pip and uv resolve WCM 0.33.1, model-signing 1.1.1, sigstore 4.5.1, cryptography 50.0.2, and pyOpenSSL 26.4.0 with this requirement; pip check passes.
• The provenance demo accepts its valid signature and rejects a wrong digest. All 13 offline demos and unit tests pass with the updated install sequence.
• On current head c4666d99361b2d24e31827911110defc04caf641, 27 hosted checks passed, including Examples / weight-custody-manifest, demos, fuzzing, and CodeQL. Three checks fail: two maintainer approval gates and the link checker receiving HTTP 451 from an unchanged Nobulex source URL. Dinakar approved this head; a qualifying code-owner review and a legitimate resolution of the link check are still needed. fix(catalog): remove unavailable Nobulex source listing #357 separately proposes removing the unavailable listing.

The upstream model-signing package should also declare this dependency for other consumers.

[dinakarjs]

I compared the overlap against main 2fc39d9 and have closed my #356. This branch already covers the shared requirements/README/LoRA setup need; maintainer #362 is the separate narrow CI repair. Please preserve your ownership and coordinate which lands first, then rebase the retained follow-up so the same CI fix is not carried twice. My #356-only pip check step is optional and not a dependency-repair prerequisite. This is consolidation/source comparison, not a fresh rerun of your demos or maintainer approval. Prepared with Codex.

[dinakarjs]

Reviewed c4666d9. Fresh Linux/Python 3.12.14 released-package environment reproduces ModuleNotFoundError: OpenSSL in provenance_model_signing.py before this requirements repair (WCM 0.33.1, model-signing 1.1.1, sigstore 4.5.1, cryptography 50.0.2). Installing this head's requirements-model-signing.txt adds pyOpenSSL 26.4.0; uv pip check passes, and run_demos.py passes all 13 offline demos and the unit tests. The two download/training scripts are explicitly skipped by that runner.

The source diff consistently updates CI, README, script instructions and LoRA composition to the shared requirement file. No additional blocker found in this bounded repair. My overlapping #356 is closed; retain your ownership and coordinate sequencing with the narrower maintainer #362, then validate the resulting final head. This approval covers this branch's inspected repair, not a live inference/training or platform run. Reviewed with OpenAI Codex.