hftools v0.14.0

One-pass integrity + safety + provenance, and interruptible scans

verify and verify-batch no longer check only hashes. Fold the security scan and the signature check into the same pass so a single command proves a repository is intact, safe to load, and from a trusted signer:

hftools verify-batch --root ./models --scan --verify-sig

• --scan runs the pickle/torch unsafe-import scan on each repository; a critical finding fails that repository.
• --verify-sig verifies each repository's stored signature, auto-recognizing keys in your trusted registry. Pin explicitly with --pubkey <name|hex|PEM|file>.

Interruptible

Long scan, verify, and verify-batch runs can now be stopped cleanly:

• Ctrl+C (SIGINT) on any platform — the operation checks for cancellation per file/repository and exits promptly.
• ESC or q on a Linux terminal — a small cbreak watcher (zero-dependency, build-tagged; no-op elsewhere) catches the keypress. Signals stay enabled and output post-processing is preserved, so the terminal is never left in a bad state.

Zero external dependencies; static binaries for macOS, Windows, and Linux on ARM64 and x86-64. Verify a download against SHA256SUMS.