github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-07 00:22:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[PR #11573] Feature/complete model signing #24125

New Issue
Open
opened 2026-04-19 17:23:54 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-19 17:23:54 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/11573
Author: @edonadei
Created: 7/30/2025
Status: 🔄 Open

Base: main ← Head: feature/complete-model-signing

📝 Commits (10+)

  • 9f49105 feat: Add signature metadata to manifest and API types
  • aa18c8f feat: Add signature status to API list response
  • bcf36fb feat: Add signature blob detection and storage infrastructure
  • 234a254 feat: Add signature verification interface with placeholder implementation
  • 301c507 feat: Add 'ollama sign' command with placeholder implementation
  • c9b49b4 feat: Add ollama verify command with comprehensive verification
  • 736ce3f feat: Add signature status on 'ollama list' command
  • c596ae9 feat: Add automatic signature verification during model pull
  • 5c42cde feat: Add signature verification warnings and summary after pull
  • c206a95 feat: Add automatic signature upload and verification during push

📊 Changes

16 files changed (+3475 additions, -9 deletions)

View changed files

📝 api/types.go (+16 -6)
📝 cmd/cmd.go (+711 -3)
📝 cmd/cmd_test.go (+159 -0)
➕ integration/signature_test.go (+447 -0)
📝 server/images.go (+42 -0)
📝 server/internal/cache/blob/cache.go (+20 -0)
📝 server/layer.go (+41 -0)
📝 server/manifest.go (+62 -0)
📝 server/manifest_test.go (+263 -0)
📝 server/routes.go (+16 -0)
➕ server/signature.go (+140 -0)
➕ server/signature_config.go (+186 -0)
➕ server/signature_config_test.go (+329 -0)
➕ server/signature_crypto.go (+254 -0)
➕ server/signature_crypto_test.go (+401 -0)
➕ server/signature_test.go (+388 -0)

📄 Description

Current child PRs

  1. Add signing model https://github.com/ollama/ollama/pull/11526

Problem Statement

Currently, Ollama has no mechanism to verify the integrity and
authenticity of models before loading them. This creates security risks
where:

  • Users cannot verify that downloaded models haven't been tampered with
  • There's no way to establish trust chains for model provenance
  • Malicious actors could potentially distribute compromised models
  • Organizations cannot enforce signature policies for model usage

Solution

This PR implements a complete cryptographic model signing and
verification system that provides:

  1. Cryptographic Signatures: Real ed25519 signatures (not placeholders)
    following the OpenSSF Model Signing (OMS) specification
  2. Trust Policies: Configurable verification policies (permissive, warn,
    strict) with trusted signer management
  3. Seamless Integration: Automatic verification during pull/push
    operations with clear security warnings
  4. CLI Commands: New ollama sign, ollama verify commands with enhanced
    ollama list showing signature status

Implementation Details

Core Components Added:

  • server/signature_crypto.go: Production-ready ed25519 cryptographic
    implementation
  • server/signature.go: Signature verification workflow and policy
    enforcement
  • server/signature_config.go: Configuration system with trusted signer
    management
  • server/manifest.go: Enhanced manifest format with signature metadata
  • cmd/cmd.go: New CLI commands and enhanced list display

Security Features:

  • OpenSSF Model Signing (OMS) v1.0 compliance with proper JSON structure
  • Real cryptographic verification using ed25519 signatures
  • Model digest computation excluding signature layers to prevent
    circular dependencies
  • Policy-based validation supporting organizational security
    requirements
  • Tampering detection through cryptographic verification of model
    integrity

Usage Examples

Basic Signing Workflow

Generate test signature for development/testing

  $ ollama sign qwen2.5:1.5b
  Model qwen2.5:1.5b found and ready to sign
    Layers: 4
    Total size: 986 MB
    No signing method specified - generating test signature
  ✅ Successfully signed model qwen2.5:1.5b with test signature

Verify a model's signature

  $ ollama verify qwen2.5:1.5b
  Model qwen2.5:1.5b signature information:
    Signer: test-signer@localhost
    Format: oms-v1.0
    Signed at: 2025-07-24T23:23:43-04:00
    Status: ✅ Signature verified

List models with signature status

  $ ollama list
  NAME                ID          SIZE      MODIFIED       SIGNATURE
  qwen2.5:1.5b       8c012d534   986 MB    2 minutes ago  ✅ Verified
  qwen2.5:0.5b       12555377d   397 MB    5 minutes ago  ✅ Verified
  llama3:8b          500a1f067   5.2 GB    2 weeks ago    Unsigned

Security Warnings During Operations

Pull operation shows verification warnings

  $ ollama pull new-model:latest
  ⚠️  Model new-model:latest is unsigned
  ⚠️  Consider using only signed models in production environments

Automatic verification during pull

  $ ollama pull signed-model:latest
  ✅ Signature verified: trusted-signer@company.com (oms-v1.0)

Production Key-Based Signing

Sign with your own ed25519 private key

  $ ollama sign --key ./my-private-key.pem my-model:latest
  ✅ Successfully signed model my-model:latest
     Signer: my-identity@organization.com
     Algorithm: ed25519

Testing

Added test suite covering:

  • ✅ Unit tests: All cryptographic functions, error handling,
    configuration
  • ✅ Integration tests: End-to-end workflows, CLI commands, manifest
    handling
  • ✅ Security tests: Tampering detection, signature uniqueness, key
    validation
  • ✅ Performance tests: Key generation and verification speed validation

All tests pass successfully with full coverage of the
signing/verification pipeline.

Backwards Compatibility

This implementation maintains full backwards compatibility:

  • ✅ Existing models continue to work (shown as "Unsigned")
  • ✅ No breaking API changes (signature fields are optional)
  • ✅ Zero impact on performance for unsigned model operations

Configuration

The system supports flexible configuration via
~/.ollama/models/config/signature.json:

  {
    "policy": "permissive",          // "permissive" | "warn" | "strict"
    "verify_on_pull": true,
    "verify_on_push": true,
    "trusted_signers": [
      {
        "name": "Organization Signer",
        "email": "signer@company.com",
        "public_key": "base64-encoded-key"
      }
    ]
  }

Future Extensions

This foundation enables future features:

  • Sigstore integration for keyless signing (infrastructure prepared)
  • Certificate-based PKI support (extensible signature format)
  • Transparency logs for audit trails (OMS format compatible)
  • Registry integration for signature distribution

Dependencies

No new external dependencies added. Implementation uses only Go standard
library:

  • crypto/ed25519 for cryptographic operations
  • crypto/sha256 for hashing and integrity verification
  • encoding/json for OMS format compliance
  • time, os, path/filepath for system operations

This PR addresses critical security needs while maintaining Ollama's
simplicity and performance. The implementation follows the OpenSSF Model
Signing specification and provides a solid foundation for model
integrity verification in production environments.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/11573 **Author:** [@edonadei](https://github.com/edonadei) **Created:** 7/30/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feature/complete-model-signing` --- ### 📝 Commits (10+) - [`9f49105`](https://github.com/ollama/ollama/commit/9f4910521ca23777a5450d4441195ca8ab5a1c47) feat: Add signature metadata to manifest and API types - [`aa18c8f`](https://github.com/ollama/ollama/commit/aa18c8fe251463cdddd31ebb7c5a47c2bc97877b) feat: Add signature status to API list response - [`bcf36fb`](https://github.com/ollama/ollama/commit/bcf36fb6b2d57155781f5e194d7e8a3311b472bf) feat: Add signature blob detection and storage infrastructure - [`234a254`](https://github.com/ollama/ollama/commit/234a254db9cd0e86f1345f0f33fd29d64a809aa2) feat: Add signature verification interface with placeholder implementation - [`301c507`](https://github.com/ollama/ollama/commit/301c5073bea43a451cb467cde1e44e080cebfbdc) feat: Add 'ollama sign' command with placeholder implementation - [`c9b49b4`](https://github.com/ollama/ollama/commit/c9b49b441e24aba89de58b9311f9472ffe901152) feat: Add ollama verify command with comprehensive verification - [`736ce3f`](https://github.com/ollama/ollama/commit/736ce3f7d107ce551b24cb6fd7eb9d6f89bee9dd) feat: Add signature status on 'ollama list' command - [`c596ae9`](https://github.com/ollama/ollama/commit/c596ae91989a88eb57d1ae993d8c73681544c9c4) feat: Add automatic signature verification during model pull - [`5c42cde`](https://github.com/ollama/ollama/commit/5c42cde2cf97153f16c2e906804489a4613c71f5) feat: Add signature verification warnings and summary after pull - [`c206a95`](https://github.com/ollama/ollama/commit/c206a9573c06bc717f7e97c5a52258bdddd00623) feat: Add automatic signature upload and verification during push ### 📊 Changes **16 files changed** (+3475 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `api/types.go` (+16 -6) 📝 `cmd/cmd.go` (+711 -3) 📝 `cmd/cmd_test.go` (+159 -0) ➕ `integration/signature_test.go` (+447 -0) 📝 `server/images.go` (+42 -0) 📝 `server/internal/cache/blob/cache.go` (+20 -0) 📝 `server/layer.go` (+41 -0) 📝 `server/manifest.go` (+62 -0) 📝 `server/manifest_test.go` (+263 -0) 📝 `server/routes.go` (+16 -0) ➕ `server/signature.go` (+140 -0) ➕ `server/signature_config.go` (+186 -0) ➕ `server/signature_config_test.go` (+329 -0) ➕ `server/signature_crypto.go` (+254 -0) ➕ `server/signature_crypto_test.go` (+401 -0) ➕ `server/signature_test.go` (+388 -0) </details> ### 📄 Description # Current child PRs 1. Add signing model https://github.com/ollama/ollama/pull/11526 # Problem Statement Currently, Ollama has no mechanism to verify the integrity and authenticity of models before loading them. This creates security risks where: - Users cannot verify that downloaded models haven't been tampered with - There's no way to establish trust chains for model provenance - Malicious actors could potentially distribute compromised models - Organizations cannot enforce signature policies for model usage # Solution This PR implements a complete cryptographic model signing and verification system that provides: 1. Cryptographic Signatures: Real ed25519 signatures (not placeholders) following the OpenSSF Model Signing (OMS) specification 2. Trust Policies: Configurable verification policies (permissive, warn, strict) with trusted signer management 3. Seamless Integration: Automatic verification during pull/push operations with clear security warnings 4. CLI Commands: New ollama sign, ollama verify commands with enhanced ollama list showing signature status # Implementation Details # Core Components Added: - server/signature_crypto.go: Production-ready ed25519 cryptographic implementation - server/signature.go: Signature verification workflow and policy enforcement - server/signature_config.go: Configuration system with trusted signer management - server/manifest.go: Enhanced manifest format with signature metadata - cmd/cmd.go: New CLI commands and enhanced list display # Security Features: - OpenSSF Model Signing (OMS) v1.0 compliance with proper JSON structure - Real cryptographic verification using ed25519 signatures - Model digest computation excluding signature layers to prevent circular dependencies - Policy-based validation supporting organizational security requirements - Tampering detection through cryptographic verification of model integrity # Usage Examples ## Basic Signing Workflow ### Generate test signature for development/testing ``` $ ollama sign qwen2.5:1.5b Model qwen2.5:1.5b found and ready to sign Layers: 4 Total size: 986 MB No signing method specified - generating test signature ✅ Successfully signed model qwen2.5:1.5b with test signature ``` ### Verify a model's signature ``` $ ollama verify qwen2.5:1.5b Model qwen2.5:1.5b signature information: Signer: test-signer@localhost Format: oms-v1.0 Signed at: 2025-07-24T23:23:43-04:00 Status: ✅ Signature verified ``` ### List models with signature status ``` $ ollama list NAME ID SIZE MODIFIED SIGNATURE qwen2.5:1.5b 8c012d534 986 MB 2 minutes ago ✅ Verified qwen2.5:0.5b 12555377d 397 MB 5 minutes ago ✅ Verified llama3:8b 500a1f067 5.2 GB 2 weeks ago Unsigned ``` ## Security Warnings During Operations ### Pull operation shows verification warnings ``` $ ollama pull new-model:latest ⚠️ Model new-model:latest is unsigned ⚠️ Consider using only signed models in production environments ``` ### Automatic verification during pull ``` $ ollama pull signed-model:latest ✅ Signature verified: trusted-signer@company.com (oms-v1.0) ``` Production Key-Based Signing ### Sign with your own ed25519 private key ``` $ ollama sign --key ./my-private-key.pem my-model:latest ✅ Successfully signed model my-model:latest Signer: my-identity@organization.com Algorithm: ed25519 ``` # Testing Added test suite covering: - ✅ Unit tests: All cryptographic functions, error handling, configuration - ✅ Integration tests: End-to-end workflows, CLI commands, manifest handling - ✅ Security tests: Tampering detection, signature uniqueness, key validation - ✅ Performance tests: Key generation and verification speed validation All tests pass successfully with full coverage of the signing/verification pipeline. # Backwards Compatibility This implementation maintains full backwards compatibility: - ✅ Existing models continue to work (shown as "Unsigned") - ✅ No breaking API changes (signature fields are optional) - ✅ Zero impact on performance for unsigned model operations # Configuration The system supports flexible configuration via ~/.ollama/models/config/signature.json: ``` { "policy": "permissive", // "permissive" | "warn" | "strict" "verify_on_pull": true, "verify_on_push": true, "trusted_signers": [ { "name": "Organization Signer", "email": "signer@company.com", "public_key": "base64-encoded-key" } ] } ``` # Future Extensions This foundation enables future features: - Sigstore integration for keyless signing (infrastructure prepared) - Certificate-based PKI support (extensible signature format) - Transparency logs for audit trails (OMS format compatible) - Registry integration for signature distribution # Dependencies No new external dependencies added. Implementation uses only Go standard library: - crypto/ed25519 for cryptographic operations - crypto/sha256 for hashing and integrity verification - encoding/json for OMS format compliance - time, os, path/filepath for system operations --- This PR addresses critical security needs while maintaining Ollama's simplicity and performance. The implementation follows the OpenSSF Model Signing specification and provides a solid foundation for model integrity verification in production environments. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-19 17:23:54 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#24125
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?