Merge pull request #1372 from pboyd/20260206-2-main-sync

Sync from upstream

Author: openshift-merge-bot[bot]

clients/python/noxfile.py

@@ -53,7 +53,7 @@ def mypy(session: Session) -> None:
 def tests(session: Session) -> None:
     """Run the test suite."""
     session.install(
-        ".",
+        ".[signing]",
         "requests",
         "pytest",
         "pytest-asyncio",
@@ -73,7 +73,7 @@ def tests(session: Session) -> None:
 def e2e_tests(session: Session) -> None:
     """Run the test suite."""
     packages = [
-        ".",
+        ".[signing]",
         "ray",
         "requests",
         "pytest",

clients/python/poetry.lock

@@ -28,11 +28,14 @@ nest-asyncio = "^1.6.0"
 huggingface-hub = { version = ">=0.20.1,<1.4.0", optional = true }
 olot = { version = "^0.1.6", optional = true }
 boto3 = { version = "^1.37.34", optional = true }
+rh-model-signing = { version = "0.0.3", optional = true }
+platformdirs = { version = "^4.0.0", optional = true }
 
 [tool.poetry.extras]
 hf = ["huggingface-hub"]
 boto3 = ["boto3"]
 olot = ["olot"]
+signing = ["rh-model-signing", "platformdirs"]
 
 [tool.poetry.group.docs]
 optional = true

clients/python/pyproject.toml

@@ -1,6 +1,25 @@
 """Signing utilities for model registry."""
 
-from model_registry.signing.exceptions import InitializationError, SigningError, VerificationError
+from model_registry.signing.exceptions import (
+    BaseSigningError,
+    InitializationError,
+    SigningError,
+    VerificationError,
+)
 from model_registry.signing.image_signer import CommandRunner, ImageSigner
+from model_registry.signing.model_signer import ModelSigner
+from model_registry.signing.token import decode_jwt_payload, extract_client_id
+from model_registry.signing.trust_manager import TrustManager
 
-__all__ = ["CommandRunner", "ImageSigner", "InitializationError", "SigningError", "VerificationError"]
+__all__ = [
+    "CommandRunner",
+    "ImageSigner",
+    "ModelSigner",
+    "TrustManager",
+    "BaseSigningError",
+    "InitializationError",
+    "SigningError",
+    "VerificationError",
+    "decode_jwt_payload",
+    "extract_client_id",
+]

clients/python/src/model_registry/signing/__init__.py

@@ -1,13 +1,17 @@
 """Exceptions for signing operations."""
 
 
-class SigningError(Exception):
-    """Raised when image signing fails."""
+class BaseSigningError(Exception):
+    """Base exception for signing operations."""
 
 
-class VerificationError(Exception):
-    """Raised when image verification fails."""
+class SigningError(BaseSigningError):
+    """Raised when signing fails."""
 
 
-class InitializationError(Exception):
-    """Raised when sigstore initialization fails."""
+class VerificationError(BaseSigningError):
+    """Raised when verification fails."""
+
+
+class InitializationError(BaseSigningError):
+    """Raised when initialization fails."""