Upload signatures/verification-instructions.txt with huggingface_hub
Browse files
signatures/verification-instructions.txt
ADDED
|
@@ -0,0 +1,40 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
====================================
|
| 2 |
+
MODEL SIGNATURE VERIFICATION GUIDE
|
| 3 |
+
====================================
|
| 4 |
+
|
| 5 |
+
Model: CohereLabs/tiny-aya-fire
|
| 6 |
+
Revision: main
|
| 7 |
+
Environment: PRODUCTION
|
| 8 |
+
Signed at: 2025-10-27T18:55:09Z
|
| 9 |
+
Workflow Run: https://github.com/cohere-ai/model-signing/actions/runs/22342042658
|
| 10 |
+
|
| 11 |
+
TRANSPARENCY LOG
|
| 12 |
+
----------------
|
| 13 |
+
This signature is recorded in the Sigstore Rekor transparency log.
|
| 14 |
+
|
| 15 |
+
Rekor Entry: https://search.sigstore.dev/?logIndex=984891597
|
| 16 |
+
Log Index: 984891597
|
| 17 |
+
Identity: https://github.com/cohere-ai/model-signing/.github/workflows/sign-model.yml@refs/heads/main
|
| 18 |
+
|
| 19 |
+
VERIFICATION
|
| 20 |
+
------------
|
| 21 |
+
To verify this signature locally:
|
| 22 |
+
|
| 23 |
+
1. Install the model-signing package:
|
| 24 |
+
pip install model-signing
|
| 25 |
+
|
| 26 |
+
2. Install huggingface_hub and download the model:
|
| 27 |
+
pip install huggingface_hub
|
| 28 |
+
huggingface-cli download CohereLabs/tiny-aya-fire --revision main --local-dir ./model
|
| 29 |
+
|
| 30 |
+
3. Verify the signature:
|
| 31 |
+
model_signing verify ./model \
|
| 32 |
+
--signature tiny-aya-fire.sig \
|
| 33 |
+
--identity "https://github.com/cohere-ai/model-signing/.github/workflows/sign-model.yml@refs/heads/main" \
|
| 34 |
+
--identity_provider "https://token.actions.githubusercontent.com" \
|
| 35 |
+
--ignore_unsigned_files
|
| 36 |
+
|
| 37 |
+
Note: This signature was created with selective file inclusion (*.safetensors,*.bin,*.json,*.txt,*.model,*.yaml,*.yml).
|
| 38 |
+
Use --ignore_unsigned_files to verify only the files that were signed.
|
| 39 |
+
|
| 40 |
+
====================================
|