[noah-ing]

Summary

The WCM example's model-signing dependency setup no longer relies on pyOpenSSL arriving transitively through sigstore. model-signing 1.1.1 imports OpenSSL.crypto but does not declare that dependency; the newer sigstore resolution exposed the missing import.

Maintainer #362 already repaired the CI install step. This PR supplies the complementary standalone setup: a shared model-signing requirements file with an explicit compatible pyOpenSSL range, README and provenance-demo instructions that use it, and inclusion from the LoRA requirements. The effective diff against current main is confined to five files under examples/weight-custody-manifest/.

Validation

• Synced with current main at 294d813f0840c89a2cbd0b7d639abc52743611f3 in signed-off merge commit 4e7239d7cc7d1fcd7e2377ee087373291e9c3fda. The resolution retains build(deps): update weight-custody-manifest requirement from >=0.32.0 to >=0.33.1 in /examples #389's WCM >=0.33.1 minimum and fix(wcm-examples): pin manifest identity in revocation and LoRA demos #405's manifest-pinning changes. The effective PR diff does not duplicate ci(examples): install pyOpenSSL for model-signing 1.1.1 #362's workflow fix.
• In a fresh Python 3.11 environment, installed requirements-model-signing.txt with WCM 0.33.1, model-signing 1.1.1 and pyOpenSSL 26.4.0. After installing pytest for the unit-test phase, run_demos.py passed all 13 offline demos and unit tests; two network/training demos were skipped by design. uv pip check found 41 compatible installed packages.
• A separate fresh environment with the released WCM model-signing extra but without this explicit pyOpenSSL requirement reproduced ModuleNotFoundError: OpenSSL in the provenance demo.
• The LoRA requirements resolved to 66 packages in a dry run. Model download and training were not run locally.
• git diff --check passed. On this merge head, 27 substantive hosted checks passed, including WCM examples, links, CodeQL and fuzzing. The two maintainer gate runs await an independent approval of this exact head before merge.

This is separate from the certifi update in #359. The upstream model-signing package should also declare its import dependency for other consumers.

[dinakarjs]

I compared the overlap against main 2fc39d9 and have closed my #356. This branch already covers the shared requirements/README/LoRA setup need; maintainer #362 is the separate narrow CI repair. Please preserve your ownership and coordinate which lands first, then rebase the retained follow-up so the same CI fix is not carried twice. My #356-only pip check step is optional and not a dependency-repair prerequisite. This is consolidation/source comparison, not a fresh rerun of your demos or maintainer approval. Prepared with Codex.

[dinakarjs]

Reviewed c4666d9. Fresh Linux/Python 3.12.14 released-package environment reproduces ModuleNotFoundError: OpenSSL in provenance_model_signing.py before this requirements repair (WCM 0.33.1, model-signing 1.1.1, sigstore 4.5.1, cryptography 50.0.2). Installing this head's requirements-model-signing.txt adds pyOpenSSL 26.4.0; uv pip check passes, and run_demos.py passes all 13 offline demos and the unit tests. The two download/training scripts are explicitly skipped by that runner.

The source diff consistently updates CI, README, script instructions and LoRA composition to the shared requirement file. No additional blocker found in this bounded repair. My overlapping #356 is closed; retain your ownership and coordinate sequencing with the narrower maintainer #362, then validate the resulting final head. This approval covers this branch's inspected repair, not a live inference/training or platform run. Reviewed with OpenAI Codex.

[carloshvp]

Approving the shared model-signing dependency repair at exact head c4666d99361b2d24e31827911110defc04caf641. The new requirements file declares pyOpenSSL alongside the released WCM model-signing extra and is consistently used by CI, the README/script instructions and LoRA setup.

Independent Python 3.12 validation: installed the hash-locked WCM test harness, then the actual shared requirements file. The resolved environment has WCM 0.33.1, model-signing 1.1.1, sigstore 4.5.1, cryptography 50.0.2 and pyOpenSSL 26.4.0; pip check passes. The actual run_demos.py passes all 13 offline demos and unit tests, including the model-signing valid-signature/wrong-digest controls. The two model download/training demos are explicitly skipped by that runner.

The narrower CI repair #362 is now merged. Please update this branch against current main and retain the shared requirements/docs/LoRA follow-up without duplicating its workflow change; the resulting final head needs fresh validation. This approval is for the reviewed source here and does not assert model training, inference, hardware validation, or a completed hosted matrix after that update. All commits carry DCO sign-off.

Reviewed with OpenAI Codex.

Current merge blocker: GitHub reports a conflict in .github/workflows/examples-ci.yml against the already merged #362, and this fork has maintainer edits disabled. The resolution is to retain the existing hash-locked WCM harness install and use python -m pip install -r requirements-model-signing.txt for the following model-signing install; that shared file already includes the compatible pyOpenSSL declaration. Please update the branch from main, resolve that install block, and rerun final-head checks. I have not pushed to your fork.

[noah-ing]

@carloshvp, could you re-review current head e7ff1c6c59478483ba30ad018b2e6694e03dae47 when convenient? #362's CI repair is now on main; the effective diff here is five WCM setup and documentation files. I resolved the conflict without a force push and reran all 13 offline demos and 10 unit tests on this head. The latest hosted run has 26 passing checks, including WCM and fuzz. The links job fails on the two Nobulex HTTP 451 references addressed by #357; the maintainer gates await a fresh approval of this head. This is a current-head review request, with no gate bypass or merge requested.

[noah-ing]

@carloshvp, I incorporated merged #357 into #360 after resolving the earlier #362 overlap. The current head is 16867bdaffdcf1dfa440174f7898d8a0297323e2; its effective diff is still the five WCM example files, with no workflow change. On this head, all 13 offline demos and 10 unit tests pass locally, and the hosted WCM and documentation-links checks pass. The approval gate is waiting for a fresh current-head maintainer review; the remaining hosted job must also finish. Could you review this head when convenient?

[carloshvp]

Reviewed current head 16867bdaffdcf1dfa440174f7898d8a0297323e2.

The effective five-file diff consistently routes the full offline suite through the shared model-signing dependency file and supplies the missing pyOpenSSL dependency. With the published WCM SDK and signing dependencies, all 13 offline demos and the unit tests pass again; whitespace checks pass. No code blocker found in this setup/documentation change. GitHub currently reports a merge conflict: synchronize with main, preserve the newer manifest-pinning correction if present, and rerun the current-head checks before merge. This approval does not resolve that conflict or cover a later merge commit.

Prepared with OpenAI Codex.

[carloshvp]

Reviewed current head 4e7239d7cc7d1fcd7e2377ee087373291e9c3fda in an isolated checkout.

The five-file setup/documentation change consistently routes offline demos through the shared model-signing requirements and supplies pyOpenSSL. The newer manifest-identity pinning on main is retained. In a fresh environment installed from the documented requirements, all 13 offline demos, their unit tests, 60 root tests and dependency consistency pass. No model download, training or hardware run was performed. This resolves the rebase follow-up to my earlier approval.

The repository CI Ruff selection and whitespace checks pass; all PR commits carry DCO sign-offs. This approves the bounded software scope. Current-head hosted checks and maintainer requirements remain applicable.

Reviewed with OpenAI Codex.