Why You Should Sign Model Artifacts and Container Images

Production pulls container images from a registry and model files from storage, and trusts whatever it finds. If an attacker, a misconfigured job or a mistaken upload replaces one of those artifacts, the service runs it without complaint. Signing gives production a way to check that an artifact came from your build pipeline and hasn't changed since.

What signing proves

A signature ties an artifact's exact contents to an identity, such as your CI pipeline. Verification checks two things: the contents match what was signed, and the signer is someone you trust. Changing a single byte breaks the signature.

Signing container images

Sigstore's cosign is the common tool. In CI, keyless signing uses the pipeline's OIDC identity, so there are no long-lived signing keys to protect:

cosign sign --yes registry.acme.com/ai-service@sha256:3f1c...

Verification checks that the signature came from your repository's workflow:

cosign verify registry.acme.com/ai-service@sha256:3f1c... \
  --certificate-identity-regexp "https://github.com/acme/ai-service/" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Sign and deploy by digest rather than tag, since tags can move.

Signing models

Model weights are artifacts too, and they're easier to tamper with because they often sit in ordinary storage buckets. The OpenSSF model signing project provides Sigstore-based tooling for signing model files and directories. At a minimum, record a checksum for each model version in your registry and verify it before loading.

Enforcing it

Signatures only help if something checks them. On Kubernetes, admission controllers such as Kyverno or Sigstore's policy controller can reject pods whose images weren't signed by your pipeline. For models, verify the signature or checksum in the init container that downloads the weights.

The strongest objection

"Our registry is private, so this is overkill." A private registry reduces the risk from outsiders, but not from compromised CI credentials, overly broad write permissions or simple mistakes. Signing also produces the audit evidence security reviews increasingly ask for.

Things to watch

• Third-party images. Verify signatures on base images and vendor images where publishers provide them.
• Emergency deployments. Decide in advance how urgent fixes get signed, so nobody disables enforcement under pressure.
• Start in audit mode. Log unsigned images for a few weeks before blocking them.

Sign images in one pipeline first, then add verification in audit mode to see what would have been blocked.