hftools v0.13.0

Automatic signing on download and verify

Signing no longer needs a separate step. With auto_sign enabled, every download, dataset, space, batch, and verify / verify-batch signs the repository with your ~/.hftools identity the moment its .sha256 manifest is written — so a recipient can prove provenance right away.

• config.yaml auto_sign is the persistent switch: hftools key init --auto-sign turns it on (creating the identity on first use).
• --sign / --sign=false overrides the config default per run, on download/dataset/space/batch and verify/verify-batch.
• verify signs only on a clean pass; watch signs once per cycle on its final verify.

hftools key init --signer you@example.com --auto-sign   # config.yaml auto_sign: true
hftools batch --list models.txt                          # each repo signed as it lands
hftools verify-batch --root ./repos                       # re-sign on a clean verify
hftools download owner/model --sign=false                 # opt out for one run

Recipients trust a signer once (hftools key trust <name> <pubkey>), then hftools verify-sig recognizes the signature and proves both integrity and provenance.

Zero external dependencies; static binaries for macOS, Windows, and Linux on ARM64 and x86-64. Verify a download against SHA256SUMS.