[noah-ing]

Summary

Fix the Examples / weight-custody-manifest job after dependency resolution drift. model-signing 1.1.1 imports OpenSSL.crypto but does not declare pyOpenSSL. The previous sigstore 4.5.0 resolution brought it in transitively; sigstore 4.5.1 does not. Add a shared, cryptography-50-compatible pyOpenSSL requirement and use it in CI, the WCM setup instructions, and the LoRA demo setup.

This is separate from the certifi update in #359; the WCM example failure reproduces on the unchanged base branch. Maintainer #362 is a narrower CI-only repair. If it lands first, this branch should be rebased to retain the shared requirements and documentation without duplicating its workflow change.

Validation and current blockers

• Reproduced ModuleNotFoundError: No module named OpenSSL in a clean Python 3.11 environment with the prior install sequence.
• Both pip and uv resolve WCM 0.33.1, model-signing 1.1.1, sigstore 4.5.1, cryptography 50.0.2, and pyOpenSSL 26.4.0 with this requirement; pip check passes.
• The provenance demo accepts its valid signature and rejects a wrong digest. All 13 offline demos and unit tests pass with the updated install sequence.
• On current head c4666d99361b2d24e31827911110defc04caf641, 27 hosted checks passed, including Examples / weight-custody-manifest, demos, fuzzing, and CodeQL. Three checks fail: two maintainer approval gates and the link checker receiving HTTP 451 from an unchanged Nobulex source URL. Dinakar approved this head; a qualifying code-owner review and a legitimate resolution of the link check are still needed. fix(catalog): remove unavailable Nobulex source listing #357 separately proposes removing the unavailable listing.

The upstream model-signing package should also declare this dependency for other consumers.

[dinakarjs]

I compared the overlap against main 2fc39d9 and have closed my #356. This branch already covers the shared requirements/README/LoRA setup need; maintainer #362 is the separate narrow CI repair. Please preserve your ownership and coordinate which lands first, then rebase the retained follow-up so the same CI fix is not carried twice. My #356-only pip check step is optional and not a dependency-repair prerequisite. This is consolidation/source comparison, not a fresh rerun of your demos or maintainer approval. Prepared with Codex.

[dinakarjs]

Reviewed c4666d9. Fresh Linux/Python 3.12.14 released-package environment reproduces ModuleNotFoundError: OpenSSL in provenance_model_signing.py before this requirements repair (WCM 0.33.1, model-signing 1.1.1, sigstore 4.5.1, cryptography 50.0.2). Installing this head's requirements-model-signing.txt adds pyOpenSSL 26.4.0; uv pip check passes, and run_demos.py passes all 13 offline demos and the unit tests. The two download/training scripts are explicitly skipped by that runner.

The source diff consistently updates CI, README, script instructions and LoRA composition to the shared requirement file. No additional blocker found in this bounded repair. My overlapping #356 is closed; retain your ownership and coordinate sequencing with the narrower maintainer #362, then validate the resulting final head. This approval covers this branch's inspected repair, not a live inference/training or platform run. Reviewed with OpenAI Codex.

[carloshvp]

Approving the shared model-signing dependency repair at exact head c4666d99361b2d24e31827911110defc04caf641. The new requirements file declares pyOpenSSL alongside the released WCM model-signing extra and is consistently used by CI, the README/script instructions and LoRA setup.

Independent Python 3.12 validation: installed the hash-locked WCM test harness, then the actual shared requirements file. The resolved environment has WCM 0.33.1, model-signing 1.1.1, sigstore 4.5.1, cryptography 50.0.2 and pyOpenSSL 26.4.0; pip check passes. The actual run_demos.py passes all 13 offline demos and unit tests, including the model-signing valid-signature/wrong-digest controls. The two model download/training demos are explicitly skipped by that runner.

The narrower CI repair #362 is now merged. Please update this branch against current main and retain the shared requirements/docs/LoRA follow-up without duplicating its workflow change; the resulting final head needs fresh validation. This approval is for the reviewed source here and does not assert model training, inference, hardware validation, or a completed hosted matrix after that update. All commits carry DCO sign-off.

Reviewed with OpenAI Codex.

Current merge blocker: GitHub reports a conflict in .github/workflows/examples-ci.yml against the already merged #362, and this fork has maintainer edits disabled. The resolution is to retain the existing hash-locked WCM harness install and use python -m pip install -r requirements-model-signing.txt for the following model-signing install; that shared file already includes the compatible pyOpenSSL declaration. Please update the branch from main, resolve that install block, and rerun final-head checks. I have not pushed to your fork.