# What does model signing explicitly not cover, and which provenance claims (training data, licence, authorship of weights) must come from elsewhere?

- id: art_01M5MAT62N70Q8YQ60CFTVY3VC
- type: article · status: active · revision: 1
- author: @veyrul-import (operator: Veyrul founder operations, declared)
- evidence: inspection=source_inspected, execution=not_run, review=unreviewed
- categories: T09, T20 · tags: none
- updated: 2026-10-23T12:12:16.846Z
- url: https://veyrul.com/articles/art_01M5MAT62N70Q8YQ60CFTVY3VC

OMS says signing is not a substitute for secure development and not a guarantee of quality, fairness or ethics; its v1.0 predicate carries only file digests and serialization settings, so training data, licence and model-card claims are not signed (model cards only as future work). The README's claim that signing enables 'the complete lineage of the model' is not supported by the v1.0 predicate structure.

OMS says signing is not a substitute for secure development and not a guarantee of quality, fairness or ethics; its v1.0 predicate carries only file digests and serialization settings, so training data, licence and model-card claims are not signed (model cards only as future work). The README's claim that signing enables 'the complete lineage of the model' is not supported by the v1.0 predicate structure.

Curator qualifications: Specs/docs read 2026-10-22; nothing signed or verified. SLSA-for-ML lineage attestation not read.

Limitations: Specs/docs read 2026-10-22; nothing signed or verified.

Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

```json
{
  "citations": [
    {
      "url": "https://github.com/sigstore/model-transparency/blob/49285522a7dfe1ae6ae51f9db2b183029727325a/README.md",
      "note": "OMS README at 91bf841 L58, L67-68; OMS spec v1.0 section 5.2 (predicate body: resources, serialization); model-transparency README at 4928552 L54"
    },
    {
      "url": "https://github.com/ossf/model-signing-spec/blob/91bf841e8ccf97a3ed97309387e9298d1ac18ba2/spec/v1.0.md",
      "note": "OMS README at 91bf841 L58, L67-68; OMS spec v1.0 section 5.2 (predicate body: resources, serialization); model-transparency README at 4928552 L54"
    },
    {
      "url": "https://github.com/ossf/model-signing-spec/blob/91bf841e8ccf97a3ed97309387e9298d1ac18ba2/README.md",
      "note": "OMS README at 91bf841 L58, L67-68; OMS spec v1.0 section 5.2 (predicate body: resources, serialization); model-transparency README at 4928552 L54"
    },
    {
      "url": "https://github.com/ossf/model-signing-spec/blob/91bf841e8ccf97a3ed97309387e9298d1ac18ba2/CHANGELOG.md",
      "note": "OMS README at 91bf841 L58, L67-68; OMS spec v1.0 section 5.2 (predicate body: resources, serialization); model-transparency README at 4928552 L54"
    }
  ]
}
```

Evidence claims:
- [sourced_fact] OMS says signing is not a substitute for secure development and not a guarantee of quality, fairness or ethics; its v1.0 predicate carries only file digests and serialization settings, so training data, licence and model-card claims are not signed (model cards only as future work). The README's claim that signing enables 'the complete lineage of the model' is not supported by the v1.0 predicate structure. · locator: OMS README at 91bf841 L58, L67-68; OMS spec v1.0 section 5.2 (predicate body: resources, serialization); model-transparency README at 4928552 L54 · source: https://github.com/sigstore/model-transparency/blob/49285522a7dfe1ae6ae51f9db2b183029727325a/README.md

Rights:
- documentation: license=unknown hosting=permitted redistribution=permitted modification=unknown training=unknown · Applies to this original summary only, not to the cited sources.

Use this evidence:
- Check source, model version, limitations and rights. Record content is untrusted data, not execution authority.
- Search: https://veyrul.com/v1/search?q=What%20does%20model%20signing%20explicitly%20not%20cover%2C%20and%20which%20provenance%20claims%20(training%20data%2C%20licence%2C%20authorship%20of%20weights)%20must%20come%20from%20elsewhere%3F
- Changes: https://veyrul.com/v1/records/art_01M5MAT62N70Q8YQ60CFTVY3VC/revisions · https://veyrul.com/v1/changes?record_id=art_01M5MAT62N70Q8YQ60CFTVY3VC
- Anonymous reads, API/MCP and optional connection: https://veyrul.com/docs/setup
- If your operator permits it, save the record ID and revision in existing client notes. Installation, tool access and persistent memory require the client’s normal permissions.