Socair OCI binding

Shape

Envelope

An in-toto Statement v1 (https://in-toto.io/Statement/v1) in a DSSE envelope with payload type application/vnd.in-toto+json, signed with Ed25519. It verifies offline: no transparency log or certificate authority is involved.

Subject

One subject: the OCI artifact by registry and repository, with its manifest digest. The attestation it names is about the model’s bytes; the binding is about the manifest that carries them.

Predicate

artifact

The OCI artifact as attach read it: name, manifest digest and media type, artifact type, the config blob’s media type and digest (named, not covered), how the layers were matched (one file, or a model directory by path), and every layer by digest, size, media type, and annotated path.

attestation

The Socair attestation it binds, by the SHA-256 of its envelope, with fields repeated from it: its subject, document id and hash, issue time, signer key id, issuer, check set version, and promotion state, and for a conditional promotion the acceptor, the accepted rows, and the acceptance’s expiry.

bound_utc

When attach signed the binding. The signer’s claim: no transparency log records it.

tool_version

The socair version that wrote it.

Sign and verify

socair attach registry.example/models/tiny:v1 \
  --attestation report.dsse.json --key operator.key \
  --trusted operator.pub
socair verify registry.example/models/tiny:v1 \
  --trusted operator.pub

What the signature means

• socair attach and socair verify with an OCI reference are in 0.1.0-rc.4 and later.
• attach verifies the attestation, and its signed acceptance when it is conditional, and checks that the artifact’s layers carry exactly the attested bytes before it signs. A raw layer (ModelPack, KitOps, Docker Model Runner) is matched by its digest; an image’s tar layers (a KServe ModelCar image, the model under /models) are matched by the files inside them, which attach reads. An image index, and a layer type the doc does not list as matched (a .tar+zstd layer among them), are refused.
• It pushes two referrers of the artifact: the binding with the attestation (artifact type application/vnd.socair.attestation.v1+json, each envelope annotated ai.socair.predicate-type), and the binding again as a Sigstore bundle, which cosign verify-attestation reads with the operator’s public key.
• A verified binding is not an approval. A policy must read the attestation’s promotion state, and for a conditional promotion decide whether conditions are acceptable and check the acceptance’s expiry.
• verify does not take the binding’s word: it verifies the attestation and matches the layers again itself. The manifest’s config blob is named but not covered.

Where it is defined

• Attestations on OCI model artifacts
• Admission verifiers

The other signed documents: Socair attestation, Socair acceptance, Socair reference feed, Socair inventory snapshot, Socair derivation record.