All posts
Topic
Model Signing
3 articles on model signing.
The AIBOM Security and Runtime Section
How to record weights format, loader settings, CVEs with a VEX verdict, model signing, MCP servers and RAG indexes in an AIBOM, with a CycloneDX example.
October 29, 2026
Who Can Attest to an AI Model, and to What
Six kinds of AI model attestation, from a supplier’s own AIBOM to an EU notified body: who issues each, and a table of what each proves and does not.
October 29, 2026
Sign an AI Model and Attest Its Provenance
A worked example: sign model files with the OpenSSF model_signing CLI, see real verify failures, add SLSA provenance in CI and link both from the AIBOM.
October 29, 2026