Repository navigation
ci(examples): install pyOpenSSL for model-signing 1.1.1 - #362
imran-siddique wants to merge 1 commit into
Conversation
sigstore 4.5.1 dropped its pyOpenSSL dependency, and model-signing 1.1.1 imports OpenSSL without declaring it, so the weight-custody-manifest job fails at import on every pull request. Reported upstream as sigstore/model-transparency#685. Signed-off-by: Imran Siddique <45405841+imran-siddique@users.noreply.github.com>
dinakarjs
left a comment
dinakarjs
left a comment
There was a problem hiding this comment.
Reviewed the single-workflow delta at e3c8dc2. It adds the directly imported pyOpenSSL package to the existing released WCM model-signing installation and records the upstream issue, without dropping a validation step.
Independent Linux/Python 3.12.14 reproduction: the released WCM 0.33.1 / model-signing 1.1.1 / sigstore 4.5.1 / cryptography 50.0.2 stack fails the provenance demo with missing OpenSSL; adding pyOpenSSL 26.4.0 makes that environment dependency-consistent and the retained #360 example tree passes all 13 offline demos plus unit tests. That is local stack evidence, not a rerun of this head's complete hosted workflow.
No additional blocker found in this narrow CI repair. The broader requirements/README/LoRA path remains with #360; my overlapping #356 is closed. Please reconcile that overlap when sequencing merges and keep normal maintainer/current-head checks. Reviewed with OpenAI Codex.
carloshvp
left a comment
carloshvp
left a comment
There was a problem hiding this comment.
Reviewed exact head e3c8dc28525abc4aef2cf23e290419dd7e7637ea in an isolated checkout.
Approving the explicit pyOpenSSL installation for the released WCM model-signing consumer. This is limited to the existing dependency installation command and its explanation; the hash-locked harness and released-package drift check are retained.
Independent fresh macOS/Python 3.12 environment: the hash-locked WCM harness plus the workflow's released WCM/model-signing installation and pyOpenSSL pass pip check. Running the exact run_demos.py consumer passes all 13 offline demos and its unit-test stage, including provenance_model_signing.py. The runner explicitly retains its two network/training exclusions.
All 29 returned current-head checks are successful or deliberately skipped, with no pending/failing result before this review. The commit carries DCO sign-off. Normal branch review rules still apply.
Reviewed with OpenAI Codex.
sigstore 4.5.1 dropped its pyOpenSSL dependency, and model-signing 1.1.1 imports OpenSSL without declaring it, so the weight-custody-manifest job fails at import on every pull request. Reported upstream as sigstore/model-transparency#685.
The install line in
examples-ci.ymlnow addspyOpenSSL, with a comment pointing at the upstream issue so it can come out once model-signing declares it.🤖 Generated with Claude Code