Hayward verify

Signed scan verdicts for popular Hugging Face models, looked up by the exact bytes of each file.

Every 6 hours this service scans the 100 most downloaded models on the Hub with Hayward, without loading them, and signs what it found with Sigstore. A verdict is analysis evidence, not a safety certificate.

The log is published under /v1/.

Check a model

pip install "hayward[sign]"

# a repo, and your download of it
hayward verify org/name ./snapshot

# one file, by its SHA-256
hayward verify --sha256 HASH

Or refuse to load anything the log does not vouch for:

import hayward.guard
hayward.guard.install(verified="strict")

What is published

• clean: no known attack found in the parts read.
• not_verified: not fully read, so not vouched for.
• remote_code: runs the repo's own Python, which is not vouched for.
• A repo with a flagged file is not published. A person reviews it first.
• No verdict is never a pass. The repo may not have been scanned, or was held back.

The log

Each run signs one checkpoint that lists every current verdict and names the checkpoint before it. Everything it points to is stored under its own hash, and every checkpoint is in Sigstore's public transparency log.

• /v1/head.json: the latest checkpoint number.
• /v1/checkpoints/N.sigstore.json: checkpoint N, signed.
• /v1/shards/SHA256.json: file hash to verdicts, one of 256 shards.
• /v1/receipts/SHA256.json: a scan receipt, by the hash of its bytes.

Anyone can check the chain with python verify_service.py monitor from the service's repository.