Add model signature and updated README explaining how to verify

README.md

@@ -271,6 +271,37 @@ We train Granite 4.0 Language Models using IBM's super computing cluster, Blue V
 **Ethical Considerations and Limitations:** 
 The use of Large Language Models involves risks and ethical considerations people must be aware of, including but not limited to: bias and fairness, misinformation, and autonomous decision-making. Granite-4.0-Tiny-Base-Preview model is not the exception in this regard. Even though this model is suited for multiple generative AI tasks, it has not undergone any safety alignment, there it may produce problematic outputs. Additionally, it remains uncertain whether smaller models might exhibit increased susceptibility to hallucination in generation scenarios by copying text verbatim from the training dataset due to their reduced sizes and memorization capacities. This aspect is currently an active area of research, and we anticipate more rigorous exploration, comprehension, and mitigations in this domain. Regarding ethics, a latent risk associated with all Large Language Models is their malicious utilization. We urge the community to use Granite-4.0-Tiny-Base-Preview model with ethical intentions and in a responsible way. 
 
+**Signature verification:**
+Model signing is an experimental feature with ongoing development, which might include breaking changes. We are releasing these capabilities to improve the integrity of our models for our security-conscious users and to facilitate feedback from the community.
+
+Before trying to verify the signature, ensure that the tensor files have been downloaded with git-lfs and that no files have been added, removed, or modified in your local git checkout:
+
+```bash
+  git lfs fetch --all
+  git lfs pull
+  git lfs checkout
+```
+
+Install the model_signing (v1.0.1) library with the following command:
+
+```bash
+   pip install 'model-signing==v1.0.1'
+```
+
+
+
+Then verify the signature with the following command ensuring that the IBM identity '[email protected]' was used for signing this model:
+
+```bash
+   python -m model_signing verify sigstore \
+     --signature model.sig \
+     --ignore-paths .git \
+     --ignore-paths .gitattributes \
+     --identity [email protected] \
+     --identity_provider https://sigstore.verify.ibm.com/oauth2 \
+     .
+```
+
 **Resources**
 - ⭐️ Learn about the latest updates with Granite: https://www.ibm.com/granite
 - 📄 Get started with tutorials, best practices, and prompt engineering advice: https://www.ibm.com/granite/docs/

model.sig

@@ -0,0 +1 @@
+{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIIC5TCCAmugAwIBAgIUbzc78Yu+fLrMMpOJhsywj6bVSa8wCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNTA3MDIyMDQ4WhcNMjUwNTA3MDIzMDQ4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEb0eNFTuuVZIV+ED6l1bbDgbFwbdze6wPxDi1hVfgUH6G6s//GnrfokdklbbEVLXOuYn7s1WWZkn3NzynyDPPN6OCAYowggGGMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUPdGknZ9GxHD9Np08KZwT7xJWnOEwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wJQYDVR0RAQH/BBswGYEXR3Jhbml0ZS5QcmV2aWV3QGlibS5jb20wNAYKKwYBBAGDvzABAQQmaHR0cHM6Ly9zaWdzdG9yZS52ZXJpZnkuaWJtLmNvbS9vYXV0aDIwNgYKKwYBBAGDvzABCAQoDCZodHRwczovL3NpZ3N0b3JlLnZlcmlmeS5pYm0uY29tL29hdXRoMjCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABlqiLrlIAAAQDAEYwRAIgRtMlQIKk2bJcHzGDiZYtPJ6bhKczJ9245e+/lvGik0QCIHmSnxcGH7w5X0Shtn4kY9Vtku1DhLYISh5o++MKbzdeMAoGCCqGSM49BAMDA2gAMGUCMCZkO/QLQ3UMp/scAQFWfoI/IFU0VQwxyhHkfi9/lRfN5dn6NLpILcxth2UWKX24yQIxAIhYJ2ShAlaYVlesy4UQ+/SDYs5bi2gRHik7Wr9w6RgKZZVgEZ93XOvtwIKJyOZtgg=="}, "tlogEntries": [{"logIndex": "207712279", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "dsse", "version": "0.0.1"}, "integratedTime": "1746584449", "inclusionPromise": {"signedEntryTimestamp": "MEUCIFkYfGutra3CvtxxVoOpxJ8aQxgHsYjy68WTuFodM9IFAiEAtL/VzYYF2VH7KVhnhAfJ0nRYiCSLiL2FqWDC6MXm0+A="}, "inclusionProof": {"logIndex": "85808017", "rootHash": "AZzO68twO8bOfTuScPYpMycQqAESAKw4bywdHZDfuaI=", "treeSize": "85808018", "hashes": ["FzkIUA+rXjqmU4x3lZsR73PK26kqzUm9C6xKLP965wA=", "uYYvMBINBcpSw3rFN1OkDHgmnUuQgLtSM6tBCvcll8E=", "GhvJhCREEMcvKKbtcWTC+1cfrhFZL6go7Gx+IhKPagw=", "G4f0OdFe3Fl3n9bth2Qh0iCziC8x1YXVGs2wRkzBWSk=", "916lAS2p6w94UcUjDRtBoJHp/mo4abZnboMnPplpa9w=", "dPtfEFBHGzJOUxcOBiGun8yVRmaQpcdbNQ+xWjeId9I=", "AcENXpcSY4XlvYf4MvNXP/YXvX4O5R5rZXDWsdvqSWc=", "cltn6y1RscbSykJMeCfOyjtjh7+FuLBfOWovOuO9b5k=", "LjZn4+YCkM1n1fAijf/qzVW86hA420ABDVZ9E8MtNqo=", "uEORZhs+UzUjVjTYcufREJZAEaZ1Web+L75AUWYSQic=", "wPskhmu15ftxHjrzbc1mbR7g3XCKtM52kdXHazaWvH4=", "++1LMuz3tIdW1/pfEfhPfXC4ot1AwDAXDcPyfibzGyc=", "7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n85808018\nAZzO68twO8bOfTuScPYpMycQqAESAKw4bywdHZDfuaI=\n\n\u2014 rekor.sigstore.dev wNI9ajBEAiBq6L60Ni5wWhI68iDSj5JzL7Sx5HAY6+yl3WhH3Y6I6QIgXi5lsLVZqgw6C5tv5YKeJjuv7XekBboE8rIQAwUWnXs=\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiMjljOTUxZGRiZjQ5ZjE2NjAxMzEzMTU2M2E1ZTVhMWMxOTJlMTEwMDA1Zjc1OTQwYmMxNGJhZjBiY2YyMzdjNSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImFhM2E1NTFmN2QzMWRmZjJjN2I3ZTM1YmIyYWJlZGI0NDIzZjU1NWEzY2FhN2I5YjQyYTgyMTg4MDg1Yzk5NTYifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVRQ0lIRjcvaVRuS1RCYnl2aGQ2SVZiNTNOMFhMWmxTYzZlSDZuZ0trYmZ2OGNlQWlCcSs5OC9qTmgwM1RiZmx6ZHVUZ1VQTVo1aXdiWFQ0bEMyeVlXcFNmdFdNUT09IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VNMVZFTkRRVzExWjBGM1NVSkJaMGxWWW5wak56aFpkU3RtVEhKTlRYQlBTbWh6ZVhkcU5tSldVMkU0ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwVmQwNVVRVE5OUkVsNVRVUlJORmRvWTA1TmFsVjNUbFJCTTAxRVNYcE5SRkUwVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVmlNR1ZPUmxSMWRWWmFTVllyUlVRMmJERmlZa1JuWWtaM1ltUjZaVFozVUhoRWFURUthRlptWjFWSU5rYzJjeTh2UjI1eVptOXJaR3RzWW1KRlZreFlUM1ZaYmpkek1WZFhXbXR1TTA1NmVXNTVSRkJRVGpaUFEwRlpiM2RuWjBkSFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVlFaRWRyQ201YU9VZDRTRVE1VG5Bd09FdGFkMVEzZUVwWGJrOUZkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMHBSV1VSV1VqQlNRVkZJTDBKQ2MzZEhXVVZZVWpOS2FHSnRiREJhVXpWUlkyMVdNbUZYVmpOUlIyeHBZbE0xYW1JeU1IZE9RVmxMUzNkWlFncENRVWRFZG5wQlFrRlJVVzFoU0ZJd1kwaE5Oa3g1T1hwaFYyUjZaRWM1ZVZwVE5USmFXRXB3V201cmRXRlhTblJNYlU1MllsTTVkbGxZVmpCaFJFbDNDazVuV1V0TGQxbENRa0ZIUkhaNlFVSkRRVkZ2UkVOYWIyUklVbmRqZW05MlRETk9jRm96VGpCaU0wcHNURzVhYkdOdGJHMWxVelZ3V1cwd2RWa3lPWFFLVERJNWFHUllVbTlOYWtOQ2FWRlpTMHQzV1VKQ1FVaFhaVkZKUlVGblVqZENTR3RCWkhkQ01VRk9NRGxOUjNKSGVIaEZlVmw0YTJWSVNteHVUbmRMYVFwVGJEWTBNMnA1ZEM4MFpVdGpiMEYyUzJVMlQwRkJRVUpzY1dsTWNteEpRVUZCVVVSQlJWbDNVa0ZKWjFKMFRXeFJTVXRyTW1KS1kwaDZSMFJwV2xsMENsQktObUpvUzJONlNqa3lORFZsS3k5c2RrZHBhekJSUTBsSWJWTnVlR05IU0RkM05WZ3dVMmgwYmpScldUbFdkR3QxTVVSb1RGbEpVMmcxYnlzclRVc0tZbnBrWlUxQmIwZERRM0ZIVTAwME9VSkJUVVJCTW1kQlRVZFZRMDFEV210UEwxRk1VVE5WVFhBdmMyTkJVVVpYWm05SkwwbEdWVEJXVVhkNGVXaElhd3BtYVRrdmJGSm1UalZrYmpaT1RIQkpUR040ZEdneVZWZExXREkwZVZGSmVFRkphRmxLTWxOb1FXeGhXVlpzWlhONU5GVlJLeTlUUkZsek5XSnBNbWRTQ2tocGF6ZFhjamwzTmxKblMxcGFWbWRGV2preldFOTJkSGRKUzBwNVQxcDBaMmM5UFFvdExTMHRMVVZPUkNCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2c9PSJ9XX19"}], "timestampVerificationData": {}}, "dsseEnvelope": {"payload": "ewogICJfdHlwZSI6ICJodHRwczovL2luLXRvdG8uaW8vU3RhdGVtZW50L3YxIiwKICAic3ViamVjdCI6IFsKICAgIHsKICAgICAgIm5hbWUiOiAiZ3Jhbml0ZS00LjAtdGlueS1iYXNlLXByZXZpZXciLAogICAgICAiZGlnZXN0IjogewogICAgICAgICJzaGEyNTYiOiAiMDRlZTMwMWEyMWU1YWYxYWFhN2E0NWMzYWY2ZWUzZTc1ZTBhOTc2OTVjZWQ2MTRiNDdlNTdhMTVhYjRiNjhmYSIKICAgICAgfQogICAgfQogIF0sCiAgInByZWRpY2F0ZVR5cGUiOiAiaHR0cHM6Ly9tb2RlbF9zaWduaW5nL3NpZ25hdHVyZS92MS4wIiwKICAicHJlZGljYXRlIjogewogICAgInJlc291cmNlcyI6IFsKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiMmZiNmQzZjJhOWYxMDg0MjRiY2IxOTM2MDM1NDg4MTcyZjc5MTkyZWIwZmYwNjNmOWY3MDhmYzI0MzdjNzMzMiIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiLAogICAgICAgICJuYW1lIjogIlJFQURNRS5tZCIKICAgICAgfSwKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiZWExNTI2N2M0ODc0MTZlZDRmOTBlMGI2ODY2YWE1MGIxYThiNGNhMmVhOThiN2NiYWFlMjM4NjJmZTZjZDNkOSIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiLAogICAgICAgICJuYW1lIjogImNvbmZpZy5qc29uIgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICIxM2I0Mjc3MDgwNDE3NTk4ZWY2MTFhNWJmYmE3MzM3N2I4OGZlMGZlZGFhNTdmZTU2ODY4YzBhMzkzZDEzYTU5IiwKICAgICAgICAiYWxnb3JpdGhtIjogInNoYTI1NiIsCiAgICAgICAgIm5hbWUiOiAiZ2VuZXJhdGlvbl9jb25maWcuanNvbiIKICAgICAgfSwKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiNTdiZTBlYmRlNzQzNTMxNzEyNjIzMmVlOWI2NGYzYmQzNWZiNWY1MTFhMTQzNTUwNDMwZjkxYWU3YThlNTJmMiIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiLAogICAgICAgICJuYW1lIjogIm1vZGVsLTAwMDAxLW9mLTAwMDA2LnNhZmV0ZW5zb3JzIgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICJiNTI1Y2FhNDNiNmZkOTAxMWRlMzIwMGFiYWUzZDI0NDRiZGZhYjM4Y2QzMGVlMmE1YjVkY2YxMDA2OWY3MTI2IiwKICAgICAgICAiYWxnb3JpdGhtIjogInNoYTI1NiIsCiAgICAgICAgIm5hbWUiOiAibW9kZWwtMDAwMDItb2YtMDAwMDYuc2FmZXRlbnNvcnMiCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAiZGlnZXN0IjogIjg3M2JmNDc4NTIyNTQzMTI3ZjU0OTM3MmI2YTdiMmI1ODMwMWM1M2UyZDE2MWRlZTA5YzNlMTY2MzJjMDE0MDMiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IiwKICAgICAgICAibmFtZSI6ICJtb2RlbC0wMDAwMy1vZi0wMDAwNi5zYWZldGVuc29ycyIKICAgICAgfSwKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiZDJkZDQ5M2Y4Nzc5ZGE1ZDdjYzUxNWI1MDY4YTNiMmUwZjlkODc3NTNlMTRjOWFiMjI4OThjNjRlOTRjYzgyOSIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiLAogICAgICAgICJuYW1lIjogIm1vZGVsLTAwMDA0LW9mLTAwMDA2LnNhZmV0ZW5zb3JzIgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICJjYzliZmE1NDNkNDE1YjQ4M2QyMTYxOTExYTQ4ZWE1YjBhNGRkNTk3YTNjMTMwZTg1YzA2NGEzZTdiNDJmNmIzIiwKICAgICAgICAiYWxnb3JpdGhtIjogInNoYTI1NiIsCiAgICAgICAgIm5hbWUiOiAibW9kZWwtMDAwMDUtb2YtMDAwMDYuc2FmZXRlbnNvcnMiCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAiZGlnZXN0IjogIjcyMzY1NzFjZjFkNTA4ODcxODE1YTU2MGQwMWJiZGQ1ODM4MjJlMTcwNWUxMTM5ZDYyNjRmZDBhMGQ1N2ZkZmEiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IiwKICAgICAgICAibmFtZSI6ICJtb2RlbC0wMDAwNi1vZi0wMDAwNi5zYWZldGVuc29ycyIKICAgICAgfSwKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiYjljZWE5YTlmZmFhOTYwMzgyZjZkNzAzZTUxNzI1YzZiYTk2NGZjM2RkODc4MGE1ZDlkMzRkNGVkYWVkZTc3MCIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiLAogICAgICAgICJuYW1lIjogIm1vZGVsLnNhZmV0ZW5zb3JzLmluZGV4Lmpzb24iCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAiZGlnZXN0IjogIjYwZmYyMjRiOTk0NWY2NmU5M2NlYmMyMWZiMTU5ZTkzYjI4OGEwYmRmNDZhZWY3NTQwNjE4NzczNDliZDA4ZjIiLAogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IiwKICAgICAgICAibmFtZSI6ICJzcGVjaWFsX3Rva2Vuc19tYXAuanNvbiIKICAgICAgfSwKICAgICAgewogICAgICAgICJkaWdlc3QiOiAiZGVmZGUzNzFkMDkzNTMwMjM3ZTVlNWExNWZiYjIzYzIyMmYwMTU5OTc0YTUxOWJjNjY4MzZiMmU4MDNiZjNlNiIsCiAgICAgICAgImFsZ29yaXRobSI6ICJzaGEyNTYiLAogICAgICAgICJuYW1lIjogInRva2VuaXplci5qc29uIgogICAgICB9LAogICAgICB7CiAgICAgICAgImRpZ2VzdCI6ICI2M2RiMjlhYmI4ZWQ3ZjhkN2MxOWVlNjg5NzhlMWIwMDJhM2VlZmIzMjFjZjNhZjA4N2U0Mzg0MzIzYzU3ODcxIiwKICAgICAgICAiYWxnb3JpdGhtIjogInNoYTI1NiIsCiAgICAgICAgIm5hbWUiOiAidG9rZW5pemVyX2NvbmZpZy5qc29uIgogICAgICB9CiAgICBdLAogICAgInNlcmlhbGl6YXRpb24iOiB7CiAgICAgICJtZXRob2QiOiAiZmlsZXMiLAogICAgICAiaGFzaF90eXBlIjogInNoYTI1NiIsCiAgICAgICJhbGxvd19zeW1saW5rcyI6IGZhbHNlCiAgICB9CiAgfQp9", "payloadType": "application/vnd.in-toto+json", "signatures": [{"sig": "MEQCIHF7/iTnKTBbyvhd6IVb53N0XLZlSc6eH6ngKkbfv8ceAiBq+98/jNh03TbflzduTgUPMZ5iwbXT4lC2yYWpSftWMQ=="}]}}