MEGA Hub
New
Docs/Models

Signing and Trust#

MEGA treats downloaded artifacts as untrusted until both integrity and provenance checks pass.

Trust model#

A trusted artifact requires:

  1. A canonical signed statement binding the payload hash, the header hash, and a source version.
  2. A code-signing leaf certificate.
  3. A valid certificate chain.
  4. A trusted root supplied by verifier policy.

The statement covers payload_sha256 (weight bytes) and header_sha256 (tensor directory: names, shapes, dtypes, offsets, checksums), so edits to either region invalidate the signature. source_version identifies the checkpoint or release, letting verifiers pin versions and reject stale or rolled-back artifacts.

Artifacts may embed the leaf certificate and intermediate chain. They do not embed the trust root.

Sign during conversion#

BASH
mega convert ./Qwen3.5-0.8B \  --output-dir ./Qwen3.5-0.8B/mega \  --sign-bundle ./signing/release-bundle.pem \  --source-version ckpt-0012

--source-version is required whenever --sign-bundle is given.

The PEM bundle contains:

-----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY----------BEGIN CERTIFICATE-----leaf certificate-----END CERTIFICATE----------BEGIN CERTIFICATE-----optional intermediate-----END CERTIFICATE-----

Sign an existing artifact#

BASH
mega sign ./Qwen3.5-0.8B/mega/model.mega.index.json \  --bundle ./signing/release-bundle.pem \  --source-version ckpt-0012

Signing the index signs all resolved shards.

Verify a release#

The example script shows the expected verification flow:

BASH
python megatensors/examples/sign_and_verify.py \  Qwen3.5-0.8B/mega/model.mega.index.json \  --bundle ./signing/release-bundle.pem \  --trusted-roots ./signing/root-ca.pem \  --model-id qwen3.5-0.8b \  --source-version ckpt-0012

Enforce provenance at load time#

Pass a TrustPolicy so artifacts are verified before any tensor is copied to the device:

PYTHON
from megatensors import TrustPolicy, load_model policy = TrustPolicy(    trusted_roots_pem=open("signing/root-ca.pem").read(),    allowed_model_ids={"qwen3.5-0.8b"},    allowed_source_versions={"ckpt-0012"},)model = load_model("Qwen3.5-0.8B/mega/model.mega.index.json", trust_policy=policy)

strict=True (default) raises on unsigned, tampered, or untrusted artifacts; strict=False downgrades failures to warnings, and allow_unsigned=True admits artifacts that carry no signature. All mega_open-based entry points (load_model, load_state_dict, load_tensor, iter_tensors) accept trust_policy=.

Risk states#

State Meaning
Valid signature, trusted root Artifact passes provenance policy.
Valid signature, unknown issuer Cryptography passed, source policy failed.
Payload hash mismatch Weight bytes changed after signing.
Header hash mismatch Tensor-directory metadata changed after signing.
Source version not allowed Artifact is stale or outside the verifier's version policy.
Expired or invalid certificate Signature is not acceptable for current policy.
Missing signature Treat as unsigned community content.

Key handling#

  • Store private keys outside the repository.
  • Rotate signing certificates without changing trusted roots unless policy requires it.
  • Keep release signing separate from developer SSH keys.
  • Record signer identity and source version in release notes for operational audit.