Socair v0.1.0-rc.6

0.1.0-rc.6 (2026-10-15)

Fixes

• scripts: the console demo's approved-with-conditions model has a gap to accept again (#281) (60af4ef)
• tokenizer: a GGUF special-token id of -1 is the "no token" sentinel, not out of range (#282) (5ab2a2a)

Socair v0.1.0-rc.5

0.1.0-rc.5 (2026-10-15)

Features

• checks: a check whose input was not supplied is named, not run: known-bad needs your list, chat template needs a template (#280) (b13ac3b)
• checks: compare an uploader's SHA256SUMS and .sha256 lists with the bytes scanned (#276) (e0df1d1)
• checks: read Keras models: HDF5 layout, .keras members, and code in the config (#278) (6c1b5e8)
• checks: read ONNX models: tensors, external data, operator domains, and metadata (#266) (09267c7)
• checks: read OpenVINO IR models: Const ranges in the .bin, operations, and rt_info text (#277) (c3c747a)
• cli: socair scan says what would close each gap; the docs say to pull only what you serve (#272) (f866a00)
• tensors: compare a model's weights with a reviewed model, tensor by tensor (#265) (4923cb5)

Fixes

• airlock: a staged scan with a FAIL or LEAD is blocked, not offered for signing (#273) (e0826af)
• checks: configs a Python loader reads are decoded as Python's json decodes them (#274) (c215f09)
• cli: every command refuses a flag it does not take (#275) (ff18a78)
• engine: write an empty fails or not_tested list as [], as the report schema says (#279) (5b77c42)
• inventory: a directory's listing is graded once, not with every file (#270) (1d4f3df)
• release: a rebuild from a tag stamps the tag's version, whatever the module cache holds (#271) (69d9577)

Socair v0.1.0-rc.4

Socair 0.1.0-rc.4 is the second public release candidate. It fixes a chat-template detection bypass in rc.3 (High, GHSA-c5hh-62j2-rfm7), and false positives that kept widely used models out of the airlock. It also adds ways to enforce a Socair verdict where models are served:

• OCI attestations, including KServe's ModelCar images;
• a Kyverno admission policy;
• a Hugging Face-compatible download endpoint.

It also adds an organization's own intake policy and attested pickle-to-safetensors conversion.

This is a pre-release. The report format (socair.report/v1) and the check set (now tier1/0.9) can still change before 0.1.0.

Security

• A chat-template trigger written as a tuple was missed. A template that opened a hidden system turn only when a message matched one of several phrases, written as content in ('a', 'b') or content.startswith(('a', 'b')), PASSed in rc.3. The analysis treated a list of constants as a content condition but not a tuple. A tuple is now a sequence like a list, so such a template is a LEAD with a trigger probe for each phrase. The detection benchmark pins the case (gguf-template-tuple-trigger). See GHSA-c5hh-62j2-rfm7.

New

• Attestations on OCI model artifacts.
  • socair attach <registry/repo:tag> binds a verified attestation to the artifact's manifest digest and pushes it as an OCI referrer. A Sigstore bundle copy lets cosign verify it with the operator's key.
  • socair verify <oci-ref> re-checks every link, the layer match included.
  • It handles raw-file layers (ModelPack, KitOps, Docker Model Runner) and images whose model sits in tar layers (KServe ModelCar). For an image, the model root must hold exactly the attested files; links, whiteouts, duplicates, and special files there are refused.
  • See docs/oci.md and https://socair.ai/oci-binding/v1.
• A Kyverno admission policy (policies/kyverno).
  • A pod naming a model image starts only when the model's binding verifies against your key and says authorized. A second policy also admits authorized with conditions until the acceptance expires.
  • KServe's oci+native:// (an image volume) and oci+fetch:// modes are admitted.
  • A ModelCar pod, which runs the image's unexamined base layers as a container, is refused unless you set runUnexaminedBase.
  • Tested end to end in kind. See docs/admission.md.
• A Hugging Face-compatible download endpoint, socair airlock serve-hub.
  • vLLM, transformers, hf download, and KServe's storage initializer download promoted models through HF_ENDPOINT.
  • It serves read-only, and only what the store admits at the moment of the request.
  • The chart can run it beside the airlock (hub.enabled, off by default). See docs/hub-endpoint.md.
• Pickle to safetensors conversion, socair airlock convert.
  • A checkpoint whose Pickle row PASSed is rebuilt as safetensors from Socair's typed model of the pickle, never by unpickling it.
  • The output is staged with a signed derivation record. It is a new artifact, scanned and promoted on its own.
  • See docs/derivation.md and https://socair.ai/derivation/v1.
• socair render --attestation r.dsse.json --trusted key.pub --pdf r.pdf renders the signed attestation after verifying it, without scanning again. --report r.json renders a saved report, marked UNSIGNED.
• Intake policy (SOCAIR_INTAKE_POLICY): an organization's rules on formats, publishers, and required signatures, as a row that can only withhold. See docs/intake-policy.md.
• A signed CycloneDX ML-BOM that meets the G7 SBOM-for-AI minimum elements (socair sign --bom, socair verify --bom). See docs/cyclonedx.md.
• NVIDIA NGC model signatures (result.sigstore) are verified in a directory scan, and certificate chains are checked at scan time. CI runs the OpenSSF Model Signing conformance suite.
• socair airlock recheck re-examines the clean store against the current feed and check set, and flags models that would now be withheld.
• Feed safety:
  • With a store, a feed older than the newest one the store has used stops the scan (rollback protection).
  • A feed in the last third of its validity warns.
• SARIF results carry stable fingerprints, so GitHub code scanning tracks one finding across scans.
• Releases carry an attested CycloneDX SBOM of the build.
• The project now has: a governance model, a threat model, a security policy with a severity ladder, CodeQL, and OpenSSF Scorecard.

Fixed

• False positives on real models:
  • Remote code is a LEAD only for the Python a loader would import, read from transformers, sentence-transformers, diffusers, and the inference toolkits at pinned releases. A training or evaluation script no loader imports is listed, not judged. sentence-transformers/all-MiniLM-L6-v2 and its siblings could never cross the airlock before. On 125 real repositories, 16 false LEADs clear, and all 22 that load their own code stay LEADs.
  • Chat template: a branch on a content part's standard type (text, image, …) is not a trigger, which clears Google's TranslateGemma template. All 73 of llama.cpp's templates PASS.
  • Pickle:
    • A torch checkpoint the grammar read in full is no longer an "unscanned archive".
    • Checkpoints with uint16/32/64, float8, or bcomplex32 tensors (torch 2.14) now PASS.
  • Provenance: a directory signed after hf download --local-dir no longer fails on its download metadata.
• First-run fixes:
  • Every rc.3 PDF printed "·" and "•" in place of punctuation.
  • The promotion section of a conditional report now says "authorized with conditions".
  • --help after a subcommand only prints usage. In rc.3, serve --help started the API and airlock init --help created a store.
  • Lists of row names are unambiguous.
• A report signed by a newer socair is refused with an error that says so, not as "not a Socair report".
• Reports no longer carry paths from the scanning host: reference inputs, helper output, and check errors.
• The keyless signature verifier and the Tier 2 helper no longer receive Socair's environment (HF_TOKEN included).
• The API reads a path only under configured scan roots. This closes the 41 CodeQL path-injection alerts; the remaining CodeQL integer-conversion alerts and two dependency advisories (golang.org/x/text) are fixed too.

Upgrading from rc.3

• socair serve refuses every path until you name a scan root.
  • Pass --scan-root <dir> (repeatable) or SOCAIR_SCAN_ROOTS.
  • With --store, the store's incoming/ is always a root.
  • The chart's scanRoots value sets them.
• The check set is tier1/0.9.
  • Some verdicts change, and docs/check-set.md lists each. Most clear false positives.
  • A few changes newly withhold:
    • a config that names a module the repository does not ship (Remote code);
    • the tuple trigger above;
    • a system turn in the else of a content-part branch;
    • a torch.cuda storage class that torch does not define.
  • Run socair airlock recheck to re-examine models promoted under tier1/0.8.
• Additive report and binding fields:
  • Framework mappings name their editions (MITRE ATLAS 2026.09, OWASP LLM 2025).
  • Reports gain scope.intake_policy when a policy is set.
  • An image's OCI binding gains model_root, layer_rules, and per-layer details.
• Upgrade every verifier with the scanners, or first. rc.3 refuses an rc.4 attestation: its strict decoder does not know the mappings' new version field (unknown field "version"). That covers an airlock's promote and socair verify in CI. An rc.4 verifier now says when a report was likely signed by a newer socair. LLMKube's admission gate (socair-verify) reads both.
• SARIF fingerprints are new, so the first upload to code scanning after upgrading opens alerts under new identities.
• With a store and a feed, the first scan records the feed in <store>/feed-record.json.

Detection results

• On the detection benchmark, Socair detects 52 of 55 defanged reproductions of published attacks, with the misses pinned. With its defaults, without the optional reference inputs, it detects 49.
• It flags none of the 8 benign controls.
• The detection ceiling (v5) lists what it does not claim to catch.

Install

brew install defilantech/tap/socair

Or download a binary below: socair, and the optional socair-sigstore helper, for linux and darwin on amd64 and arm64.

On Kubernetes:

helm repo add socair https://defilantech.github.io/socair
helm pull socair/socair --version 0.1.0-rc.4

The image is ghcr.io/defilantech/socair:0.1.0-rc.4, and the chart is also at oci://ghcr.io/defilantech/charts/socair.

Verify

gh attestation verify socair_0.1.0-rc.4_linux_amd64 --repo defilantech/socair \
  --signer-workflow defilantech/socair/.github/workflows/release.yml

• socair_0.1.0-rc.4.intoto.jsonl holds the binaries' and the chart's attestations, for offline verification with --bundle.
• The SBOM is attested too.
• Builds are reproducible from the tag.

See verify-release.md.

Known limitations

• The macOS binaries are not notarized; see verify-release.md.
• There are no Windows builds yet (#191).
• Sigstore policy-controller accepts only keyless bundles, not key-signed ones, so it is not served.
• PDF text outside Windows-1252 (CJK in a template's notes, say) prints as <U+XXXX> code points.

Changes: https://github.com/defilantech/socair/compare/...

Socair v0.1.0-rc.3

Socair 0.1.0-rc.3 is the first public release candidate.

Socair inspects an open-weight model artifact (a GGUF file, safetensors, a pickle checkpoint, or a whole Hugging Face model directory) and produces an attestation: a graded report a security team can file, signed so anyone can verify it offline. Each check returns PASS, FAIL, LEAD, or NOT_TESTED, and nothing passes silently.

This is a pre-release. The report format (socair.report/v1) and the check set (tier1/0.8) can still change before 0.1.0.

What's in it

• Checks: format and structure, file inventory and payloads, chat template (Jinja analysis, and rendering with Socair's own evaluator), tokenizer config, quant match, pickle opcode scan (a typed grammar: a PASS means the pickle builds only tensors), remote code, provenance and publisher signatures (OpenSSF Model Signing), known-bad hashes, and an opt-in license policy.
• Attestations: an in-toto Statement v1 in a DSSE envelope, signed with Ed25519 and verified offline. Untested rows cross only with a signed, expiring acceptance from a named person. Reference data comes as signed feeds.
• The airlock: pulls models pinned to a hash or commit, promotes only with a trusted attestation, and keeps a hash-chained log.
• Reports as JSON, HTML, PDF, SARIF, and CycloneDX.
• The wizard and console, and a Helm chart and container image for running the airlock on Kubernetes.
• Tier 2 foundation: the report section and the probe-helper protocol for checks that run the model on your own GPUs. The checks themselves are on the roadmap.

On the detection benchmark, Socair detects 44 of 46 defanged reproductions of published attacks (41 without the optional reference inputs), with the misses pinned, and flags none of the 6 benign controls. The detection ceiling lists what it does not claim to catch.

Install

brew install defilantech/tap/socair

Or download a binary below (socair, and the optional socair-sigstore helper, for linux and darwin on amd64 and arm64). On Kubernetes:

helm repo add socair https://defilantech.github.io/socair
helm pull socair/socair --version 0.1.0-rc.3

The image is ghcr.io/defilantech/socair:0.1.0-rc.3, and the chart is also at oci://ghcr.io/defilantech/charts/socair. See kubernetes.md.

Verify

Every binary, the chart, and the image carry a build-provenance attestation:

gh attestation verify socair_0.1.0-rc.3_linux_amd64 --repo defilantech/socair \
  --signer-workflow defilantech/socair/.github/workflows/release.yml

socair_0.1.0-rc.3.intoto.jsonl holds the same attestations for the binaries and the chart, for verifying with --bundle without fetching them. Builds are reproducible from the tag. See verify-release.md.

Known limitations

• The macOS binaries are not notarized; see verify-release.md for clearing the quarantine after verifying.
• No Windows builds yet (#191).
• The release binaries do not include the wizard; build it from a checkout, or use the container image.

v0.1.0-rc.2 was tagged but never released: its chart step failed, and release tags cannot be moved, so the fix ships here.

Changes: https://github.com/defilantech/socair/commits/v0.1.0-rc.3