github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[PR #11526] server: add signature metadata to manifest format #18840

New Issue
Open
opened 2026-04-16 06:48:39 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-16 06:48:39 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/11526
Author: @edonadei
Created: 7/25/2025
Status: 🔄 Open

Base: main ← Head: main

📝 Commits (2)

  • 88469e6 server: add signature metadata to manifest format
  • 051c840 clean up comments to stay consistent with the rest of the file

📊 Changes

1 file changed (+11 additions, -0 deletions)

View changed files

📝 server/manifest.go (+11 -0)

📄 Description

Problem

Currently, Ollama has no mechanism to store or track signature
information for models. To enable future model integrity
verification, we need a way to associate signature metadata with
model manifests.

Solution

This PR adds an optional SignatureInfo struct to the Manifest format
to prepare for model signature verification capabilities. The change
is designed to be completely backwards compatible with existing
unsigned models.

Changes

Core Changes:

  • Add SignatureInfo struct with fields for signature metadata:
    • Format: signature format version (e.g., "oms-v1.0")
    • SignatureURI: reference to signature file location
    • Verified: boolean indicating verification status
    • Signer: identity of the signer (optional)
    • SignedAt: timestamp when model was signed (optional)
  • Add optional Signature field to Manifest using omitempty JSON tag
    for backwards compatibility

Testing:

No business logic to test yet.

Backwards Compatibility

✅ Fully backwards compatible - existing manifests continue to work
unchanged:

  • Uses json:"signature,omitempty" to exclude field when nil
  • No behavioral changes to existing code paths
  • All existing tests continue to pass

Usage Example

  // Future usage - model with signature
  manifest := &Manifest{
      SchemaVersion: 2,
      MediaType:
  "application/vnd.docker.distribution.manifest.v2+json",
      Config:        layer,
      Layers:        []Layer{modelLayer},
      Signature: &SignatureInfo{
          Format:       "oms-v1.0",
          SignatureURI: "sha256:abc123...",
          Verified:     true,
          Signer:       "signer@example.com",
          SignedAt:     time.Now(),
      },
  }

  // Existing usage - unchanged
  manifest := &Manifest{
      SchemaVersion: 2,
      Config:        layer,
      Layers:        []Layer{modelLayer},
      // No signature field - works exactly as before
  }

Testing

All existing tests pass

go test ./server -run TestManifests -v

Future Work

This struct provides the foundation for upcoming PRs that will add:

  • Signature verification workflows
  • CLI commands for signing/verifying models
  • Integration with model pull/push operations

Draft PR with the full implementation #11573

Files Changed

  • server/manifest.go - Add SignatureInfo struct and optional
    Manifest.Signature field

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/11526 **Author:** [@edonadei](https://github.com/edonadei) **Created:** 7/25/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `main` --- ### 📝 Commits (2) - [`88469e6`](https://github.com/ollama/ollama/commit/88469e692cc475abb92a554c10ed47c9dca20cc2) server: add signature metadata to manifest format - [`051c840`](https://github.com/ollama/ollama/commit/051c8403549d366e63dfb1ed01844353a4505aea) clean up comments to stay consistent with the rest of the file ### 📊 Changes **1 file changed** (+11 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `server/manifest.go` (+11 -0) </details> ### 📄 Description # Problem Currently, Ollama has no mechanism to store or track signature information for models. To enable future model integrity verification, we need a way to associate signature metadata with model manifests. # Solution This PR adds an optional SignatureInfo struct to the Manifest format to prepare for model signature verification capabilities. The change is designed to be completely backwards compatible with existing unsigned models. # Changes ## Core Changes: - Add SignatureInfo struct with fields for signature metadata: - Format: signature format version (e.g., "oms-v1.0") - SignatureURI: reference to signature file location - Verified: boolean indicating verification status - Signer: identity of the signer (optional) - SignedAt: timestamp when model was signed (optional) - Add optional Signature field to Manifest using omitempty JSON tag for backwards compatibility ## Testing: No business logic to test yet. ## Backwards Compatibility ✅ Fully backwards compatible - existing manifests continue to work unchanged: - Uses `json:"signature,omitempty"` to exclude field when nil - No behavioral changes to existing code paths - All existing tests continue to pass ## Usage Example ``` // Future usage - model with signature manifest := &Manifest{ SchemaVersion: 2, MediaType: "application/vnd.docker.distribution.manifest.v2+json", Config: layer, Layers: []Layer{modelLayer}, Signature: &SignatureInfo{ Format: "oms-v1.0", SignatureURI: "sha256:abc123...", Verified: true, Signer: "signer@example.com", SignedAt: time.Now(), }, } // Existing usage - unchanged manifest := &Manifest{ SchemaVersion: 2, Config: layer, Layers: []Layer{modelLayer}, // No signature field - works exactly as before } ``` # Testing ## All existing tests pass `go test ./server -run TestManifests -v` # Future Work This struct provides the foundation for upcoming PRs that will add: - Signature verification workflows - CLI commands for signing/verifying models - Integration with model pull/push operations Draft PR with the full implementation #11573 # Files Changed - `server/manifest.go` - Add SignatureInfo struct and optional Manifest.Signature field --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-16 06:48:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#18840
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?