soup-cli 0.71.1__tar.gz → 0.71.2__tar.gz

{soup_cli-0.71.1 → soup_cli-0.71.2}/CHANGELOG.md

@@ -12,6 +12,45 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+## [0.71.2] - 2026-06-01
+
+### Added
+- **ed25519 signing for `soup adapters sign` / `soup attest`** — real detached
+  signatures (over the adapter Merkle root / the in-toto statement) via a new
+  `[sign]` extra (`pip install soup-cli[sign]`, pulling `cryptography`).
+  `soup adapters sign --backend ed25519 --key <priv.pem>` (or `--generate-key
+  <out.pem>`, or `SOUP_SIGNING_KEY`); `soup adapters verify [--public-key
+  <trusted.pem>]` does a cryptographic verify and, with a trusted key, genuine
+  authentication. `soup attest emit --sign ed25519 --key <priv.pem>` writes a
+  `<output>.sig` sidecar; new `soup attest verify <statement> --signature <sig>`
+  verifies it (canonical-JSON, so it's platform/newline-independent). Sigstore
+  keyless signing stays infra-blocked (needs an OIDC provider + Fulcio/Rekor
+  network — can't be honestly validated offline).
+- **Anti-AI-Jacking namespace pin on Hub downloads** — HF model fetches now
+  consult a trust-on-first-use pin store: a repo whose author changes (or whose
+  `created_at` jumps backward) is refused unless the namespace shift is explicitly
+  allowed. Fails open when repo metadata is unavailable.
+- **License auto-detection at `soup adapters merge`** — when `--license` isn't
+  given, the license is read from each adapter's `adapter_config.json` /
+  `config.json` / model-card frontmatter (HF `llama3.1`-style ids mapped to
+  canonical) and the conflict gate runs automatically.
+- **Backdoor-scan gate at `soup adapters merge`** — refuses to merge any input
+  whose `soup adapters scan` returns FAIL (or can't be scanned) unless
+  `--allow-unscanned` is passed; WARN is advisory.
+
+### Changed
+- License-conflict overrides (`--license-override <reason>`) are now recorded to
+  the audit log for legal review.
+- The namespace-pin store now uses SQLite WAL + busy-timeout and a cross-process
+  file lock around its get+insert, so concurrent writers don't lose the trust
+  anchor.
+
+### Security
+- ed25519 verification fails closed (any tamper / wrong key / missing key ⇒
+  invalid). Signing keys + trusted public keys are symlink-rejected and
+  size-capped via a shared reader (no cwd-containment — keys live outside the
+  project). `--generate-key` refuses to overwrite any existing path.
+
 ## [0.71.1] - 2026-06-01
 
 ### Added

{soup_cli-0.71.1 → soup_cli-0.71.2}/CONTRIBUTING.md

@@ -31,6 +31,8 @@ This installs:
 - the full training stack — `[dev]` self-references `[train]`, so `torch`,
   `transformers`, `peft`, `trl`, `datasets`, `bitsandbytes`, `accelerate` are
   pulled in too (since v0.71.0 these are an opt-in extra, not core deps)
+- `cryptography` — `[dev]` also pulls it in (it's the `[sign]` extra) so the
+  ed25519 signing tests (`soup adapters sign` / `soup attest`) run in CI
 
 ### 3. Verify Setup
 
@@ -116,7 +118,7 @@ src/soup_cli/
   templates/          - 17 built-in soup.yaml templates (YAML + manifest.json) with load_template loader (v0.39.0, +bco v0.40.0)
   ui/                 - Web UI (FastAPI + HTML/JS SPA)
 
-tests/                - Test suite (271 files, 12153 tests)
+tests/                - Test suite (272 files, 12259 tests)
 examples/             - Real-world config examples and datasets
 ```
 

{soup_cli-0.71.1 → soup_cli-0.71.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: soup-cli
-Version: 0.71.1
+Version: 0.71.2
 Summary: Fine-tune LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -51,6 +51,7 @@ Requires-Dist: deepspeed>=0.12.0; extra == 'deepspeed'
 Provides-Extra: dev
 Requires-Dist: accelerate>=0.25.0; extra == 'dev'
 Requires-Dist: bitsandbytes>=0.41.0; extra == 'dev'
+Requires-Dist: cryptography>=41.0.0; extra == 'dev'
 Requires-Dist: datasets>=2.14.0; extra == 'dev'
 Requires-Dist: httpx>=0.24.0; extra == 'dev'
 Requires-Dist: mypy>=1.8.0; extra == 'dev'
@@ -99,6 +100,8 @@ Provides-Extra: sglang
 Requires-Dist: fastapi>=0.104.0; extra == 'sglang'
 Requires-Dist: sglang>=0.2.0; extra == 'sglang'
 Requires-Dist: uvicorn>=0.24.0; extra == 'sglang'
+Provides-Extra: sign
+Requires-Dist: cryptography>=41.0.0; extra == 'sign'
 Provides-Extra: tensorrt
 Requires-Dist: tensorrt-llm>=0.9.0; extra == 'tensorrt'
 Provides-Extra: trackers
@@ -175,19 +178,19 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.1 — Quick wins + wiring.** Seven small-but-sharp closures:
-
-- **`soup env fix`** renders a reproducible install plan (copy/paste `uv pip` commands or a
-  `requirements.txt`) straight from `soup-env.lock` — print-only, no surprise package-manager calls.
-- **`soup lock write --env-lock`** auto-derives the env hash from `soup-env.lock` so you never
-  hand-copy a 64-hex string after `soup env lock`.
-- **`soup serve --record-thumbs <db>`** captures 👍/👎 feedback into a local-RL SQLite, plus a new
-  `POST /v1/thumbs` endpoint — the start of an on-box feedback flywheel.
-- **Judge calibration persistence** — write/load a `JudgeCalibrationReport` as JSON, backed by a new
-  `judge_calibration` registry artifact kind.
-- **Bundled MUSE + WMDP unlearning eval fixtures** so `soup eval unlearning --benchmark muse|wmdp`
-  runs out of the box (WMDP forget-set probes ship **redacted** — never verbatim hazardous content).
-- **`soup completions`** now introspects a cached base model's real LoRA target modules.
+**v0.71.2 — Governance & supply-chain live.** Real signatures and supply-chain gates:
+
+- **ed25519 signing** — `soup adapters sign --backend ed25519 --key priv.pem` (or `--generate-key`)
+  produces a real detached signature over the adapter's Merkle root; `soup adapters verify
+  --public-key trusted.pem` does cryptographic authentication. Same for `soup attest emit
+  --sign ed25519` + the new `soup attest verify`. Install with `pip install soup-cli[sign]`.
+- **Anti-AI-Jacking namespace pin** — Hub model downloads now refuse a repo whose author silently
+  changed (or whose creation date jumped backward), the classic namespace-re-creation attack.
+- **License-conflict gate at merge** — `soup adapters merge` auto-detects each adapter's license
+  (from `adapter_config.json` / model card) and refuses incompatible combinations unless you pass
+  `--license-override <reason>` (logged to the audit trail).
+- **Backdoor-scan gate at merge** — refuses to merge any adapter that `soup adapters scan` flags
+  FAIL unless you pass `--allow-unscanned`.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.1 → soup_cli-0.71.2}/README.md

@@ -49,19 +49,19 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.71.1 — Quick wins + wiring.** Seven small-but-sharp closures:
-
-- **`soup env fix`** renders a reproducible install plan (copy/paste `uv pip` commands or a
-  `requirements.txt`) straight from `soup-env.lock` — print-only, no surprise package-manager calls.
-- **`soup lock write --env-lock`** auto-derives the env hash from `soup-env.lock` so you never
-  hand-copy a 64-hex string after `soup env lock`.
-- **`soup serve --record-thumbs <db>`** captures 👍/👎 feedback into a local-RL SQLite, plus a new
-  `POST /v1/thumbs` endpoint — the start of an on-box feedback flywheel.
-- **Judge calibration persistence** — write/load a `JudgeCalibrationReport` as JSON, backed by a new
-  `judge_calibration` registry artifact kind.
-- **Bundled MUSE + WMDP unlearning eval fixtures** so `soup eval unlearning --benchmark muse|wmdp`
-  runs out of the box (WMDP forget-set probes ship **redacted** — never verbatim hazardous content).
-- **`soup completions`** now introspects a cached base model's real LoRA target modules.
+**v0.71.2 — Governance & supply-chain live.** Real signatures and supply-chain gates:
+
+- **ed25519 signing** — `soup adapters sign --backend ed25519 --key priv.pem` (or `--generate-key`)
+  produces a real detached signature over the adapter's Merkle root; `soup adapters verify
+  --public-key trusted.pem` does cryptographic authentication. Same for `soup attest emit
+  --sign ed25519` + the new `soup attest verify`. Install with `pip install soup-cli[sign]`.
+- **Anti-AI-Jacking namespace pin** — Hub model downloads now refuse a repo whose author silently
+  changed (or whose creation date jumped backward), the classic namespace-re-creation attack.
+- **License-conflict gate at merge** — `soup adapters merge` auto-detects each adapter's license
+  (from `adapter_config.json` / model card) and refuses incompatible combinations unless you pass
+  `--license-override <reason>` (logged to the audit trail).
+- **Backdoor-scan gate at merge** — refuses to merge any adapter that `soup adapters scan` flags
+  FAIL unless you pass `--allow-unscanned`.
 
 Full history: [CHANGELOG.md](CHANGELOG.md) &middot; [GitHub Releases](https://github.com/MakazhanAlpamys/Soup/releases).
 

{soup_cli-0.71.1 → soup_cli-0.71.2}/docs/adapters-and-governance.md

@@ -336,7 +336,20 @@ soup attest emit \
 
 Stages are a closed allowlist: `extract` / `train` / `eval` / `export` / `publish`.
 Subject SHA must be 64-hex (sha256). The default `--sign unsigned` backend ships now;
-Sigstore (OIDC-via-GitHub) and ed25519 air-gap signing arrive in v0.59.1.
+the **`ed25519` backend is live** (`pip install soup-cli[sign]`):
+
+```bash
+soup attest emit --stage train --subject adapter-v1 --sha aaaa...64hex \
+  --sign ed25519 --key signing.pem --output att.json   # writes att.json.sig
+soup attest verify att.json --signature att.json.sig                 # exit 0 valid
+soup attest verify att.json --signature att.json.sig --public-key trusted.pub
+```
+
+`verify` re-canonicalises the statement JSON (so it's platform/newline-independent)
+and checks the ed25519 signature — exit 3 on tamper, key mismatch, or a sidecar with
+no public key. A valid signature proves the signer *asserted* the statement; it does
+not re-verify the subject digest against an artifact. Sigstore keyless signing remains
+infra-blocked (needs an OIDC identity provider + Fulcio/Rekor network).
 
 
 ## EU AI Act Annex XI/XII Auto-Doc (`soup train --annex-xi`)
@@ -397,12 +410,29 @@ v0.57.0 `adapter_diff` loader so the on-disk surface stays single-source.
 
 Deterministic Merkle-root manifest over every file in the adapter dir
 (including nested `tokenizer/` / `processor/` subdirs). Tamper any file
-and `verify` fails. The `unsigned` backend ships live for offline tamper
-detection (the Merkle-root hash is the trust anchor); `sigstore` and
-`ed25519` backends raise `NotImplementedError` with v0.60.1 marker so CI
-pipelines can integrate the schema today. Signature persists as
-`.soup-signature.json` written atomically via the shared
-`atomic_write_text` helper. `--strict` mode exits 3 on any verify
+and `verify` fails. The `unsigned` backend gives offline tamper detection
+(the Merkle-root hash is the trust anchor). The **`ed25519` backend is live**
+(`pip install soup-cli[sign]`): it adds a real detached signature over the
+Merkle root for *authentication* — proof the signer holds the private key.
+
+```bash
+# generate a keypair + sign in one shot
+soup adapters sign ./adapter --backend ed25519 --generate-key signing.pem
+# or sign with an existing key (or set SOUP_SIGNING_KEY)
+soup adapters sign ./adapter --backend ed25519 --key signing.pem
+# self-consistency verify (embedded public key)
+soup adapters verify ./adapter
+# genuine authentication: require the signer's key match a trusted one
+soup adapters verify ./adapter --public-key trusted.pub
+```
+
+`verify` fails closed — any tamper, wrong/missing/unreadable key, or a
+signature from an untrusted key marks the adapter invalid. Signing keys and
+trusted public keys are symlink-rejected and size-capped but **not**
+cwd-contained (keys are secrets that live outside the project). Signature
+persists as `.soup-signature.json` (atomic write). `sigstore` keyless signing
+stays infra-blocked (needs an OIDC identity provider + Fulcio/Rekor network —
+it can't be honestly validated offline). `--strict` mode exits 3 on any verify
 failure (CI gate code distinct from generic errors).
 
 
@@ -428,9 +458,12 @@ bool rejected so callers can't smuggle a free-for-all bypass). Threat
 model: an attacker watches a popular repo, waits for the original owner
 to delete or expire it, then re-creates the same `owner/name` with
 malicious weights. Without this control, anyone with Soup pinned to that
-namespace silently pulls poison on the next run. Live wiring into
-`utils/hubs.download_repo` lands in v0.60.1; today the helpers are
-operator-callable via the Python API.
+namespace silently pulls poison on the next run. **The gate is wired into
+Hub model downloads** — it consults the pin before fetching and refuses a
+mismatch (raising before any weights land). It fails **open** when repo
+metadata can't be fetched (offline / rate-limited) so a transient hiccup
+never blocks a legitimate download. The pin store uses SQLite WAL + a
+cross-process file lock so concurrent fetches don't lose the trust anchor.
 
 
 ## License-Conflict Matrix at Merge
@@ -440,10 +473,17 @@ MIT / BSD / LGPL / MPL / GPL / AGPL / CC-BY / CC-BY-NC / Llama-2/3.x /
 Gemma / Qwen-research / Mistral-research / OpenRAIL / OpenAI-ToS /
 Anthropic-AUP. `soup adapters merge --license apache-2.0 --license
 cc-by-nc-4.0 -o merged` refuses (non-commercial cannot combine with
-permissive). To proceed past a flagged conflict, pass
-`--license-override "legal-cleared 2026-05-19 by alice"` (8-char min,
-4096-char max reason). The override reason surfaces in the merge panel;
-audit-log integration lands in v0.60.1.
+permissive). When you don't pass `--license`, the license is
+**auto-detected** from each adapter's `adapter_config.json` / `config.json`
+/ model-card frontmatter (HF `llama3.1`-style ids map to canonical) and the
+gate runs automatically when every adapter resolves to a known license. To
+proceed past a flagged conflict, pass `--license-override "legal-cleared
+2026-05-19 by alice"` (8-char min, 4096-char max reason) — the decision is
+**recorded to the audit log** for later legal review.
+
+Merge is additionally gated by the backdoor scanner: any input that
+`soup adapters scan` flags FAIL (or that can't be scanned) refuses the
+merge with exit 3 unless you pass `--allow-unscanned`.
 
 
 ## Airgap Bundle (`soup airgap-bundle`)

{soup_cli-0.71.1 → soup_cli-0.71.2}/docs/commands.md

@@ -151,10 +151,12 @@ soup serve --reasoning-parser deepseek-r1     Strip <think> blocks from response
 soup doctor [--nccl]                          Check environment (optionally check NCCL bandwidth)
 soup quickstart [--dry-run]                   Full demo
 soup adapters scan <adapter>                  Spectral backdoor scan (rank-1 dominance + outlier detection)
-soup adapters sign <adapter> [--backend X]    Compute Merkle-root manifest (.soup-signature.json)
-soup adapters verify <adapter> [--strict]     Verify manifest against current files
+soup adapters sign <adapter> [--backend unsigned|ed25519] [--key <pem>|--generate-key <pem>]  Merkle manifest + ed25519 sign
+soup adapters verify <adapter> [--strict] [--public-key <pem>]  Verify manifest + ed25519 signature
 soup adapters check-safetensors <adapter> [--strict]  Refuse pickle / PyTorch-classic weights
-soup adapters merge ... --license <id> --license-override <reason>  License-conflict gate
+soup adapters merge ... [--license <id>] [--license-override <reason>] [--allow-unscanned]  License + backdoor-scan gates (auto-detect license; scan FAIL refused)
+soup attest emit ... [--sign ed25519 --key <pem>] [-o att.json]  in-toto/SLSA-3 attestation (+ .sig sidecar)
+soup attest verify <statement> --signature <sig> [--public-key <pem>]  Verify ed25519 attestation signature
 soup airgap-bundle --model <m> --output <out.tar>  Signed tarball for data-diode transfer
 soup eval unlearning <run-id> --benchmark tofu|muse|wmdp  Forget Quality + Model Utility + PrivLeak verdict
 soup edit set --base <m> --method rome|memit|alphaedit --subject "..." --target "..."  Surgical knowledge edit (--plan-only available)

{soup_cli-0.71.1 → soup_cli-0.71.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "soup-cli"
-version = "0.71.1"
+version = "0.71.2"
 description = "Fine-tune LLMs in one command. No SSH, no config hell."
 readme = "README.md"
 license = "Apache-2.0"
@@ -54,7 +54,7 @@ wandb = ["wandb>=0.15.0,<0.18.0"]
 # Self-references `[train]` so CI / contributors get the full training stack
 # (CI runs `pip install -e ".[dev]"`; without this every test would fail at
 # `import torch`).
-dev = ["soup-cli[train]", "pytest>=7.0", "ruff>=0.1.0", "pytest-cov>=4.0", "httpx>=0.24.0", "mypy>=1.8.0", "pre-commit>=3.5.0"]
+dev = ["soup-cli[train]", "cryptography>=41.0.0", "pytest>=7.0", "ruff>=0.1.0", "pytest-cov>=4.0", "httpx>=0.24.0", "mypy>=1.8.0", "pre-commit>=3.5.0"]
 ui = ["fastapi>=0.104.0", "uvicorn>=0.24.0"]
 serve = ["fastapi>=0.104.0", "uvicorn>=0.24.0"]
 serve-fast = ["vllm>=0.4.0", "fastapi>=0.104.0", "uvicorn>=0.24.0"]
@@ -85,6 +85,10 @@ mix = ["scikit-optimize>=0.9.0"]
 # presidio-analyzer (PII). Llama-Guard-3-1B is documented as a manual recipe
 # (license + ~600 MB weight blob too large to bundle by default).
 data-pro = ["langdetect>=1.0.9", "presidio-analyzer>=2.2.0"]
+# v0.71.2 #179/#185 — ed25519 detached signing for `soup attest` / `soup
+# adapters sign`. Pure-offline; Sigstore keyless (OIDC + Fulcio/Rekor network)
+# stays infra-blocked and is NOT bundled here.
+sign = ["cryptography>=41.0.0"]
 
 [project.scripts]
 soup = "soup_cli.cli:run"

{soup_cli-0.71.1 → soup_cli-0.71.2}/src/soup_cli/__init__.py

@@ -1,3 +1,3 @@
 """Soup CLI — Fine-tune LLMs in one command."""
 
-__version__ = "0.71.1"
+__version__ = "0.71.2"

{soup_cli-0.71.1 → soup_cli-0.71.2}/src/soup_cli/commands/adapters.py

@@ -371,7 +371,15 @@ def merge(
         None, "--license-override",
         help=(
             "Free-text justification (>=8 chars) to merge across a license "
-            "conflict. Logged for legal review."
+            "conflict. Logged to the audit log for legal review (v0.71.2)."
+        ),
+    ),
+    allow_unscanned: bool = typer.Option(
+        False, "--allow-unscanned",
+        help=(
+            "Skip the v0.71.2 backdoor-scan gate. By default `adapters merge` "
+            "refuses to merge an input whose `adapters scan` returns FAIL (or "
+            "that cannot be scanned)."
         ),
     ),
 ):
@@ -379,6 +387,8 @@ def merge(
     from soup_cli.utils.adapter_merge import SUPPORTED_STRATEGIES, merge_adapters
     from soup_cli.utils.license_matrix import (
         check_license_compat,
+        extract_license_from_adapter,
+        record_license_override,
         validate_license_override_reason,
     )
 
@@ -435,8 +445,44 @@ def merge(
         console.print(panel)
         return
 
-    # v0.60.0 Part E: license-conflict gate. Operators MUST declare a
-    # license per adapter (or pass --license-override <reason>).
+    # v0.71.2 #192 — backdoor-scan gate. Refuse to merge any input whose
+    # spectral scan returns FAIL (or that cannot be scanned at all) unless the
+    # operator passes --allow-unscanned. WARN is advisory-only. Runs AFTER the
+    # cmaes plan-only branch (which doesn't merge weights) so it gates only the
+    # strategies that actually write a merged adapter.
+    if not allow_unscanned:
+        from soup_cli.utils.adapter_scan import scan_adapter
+
+        for adapter_path in adapters:
+            try:
+                scan_report = scan_adapter(adapter_path)
+            except (FileNotFoundError, ValueError, TypeError, RuntimeError) as exc:
+                console.print(
+                    f"[red]Could not scan {escape(adapter_path)} "
+                    f"({escape(str(exc))}).[/]\n"
+                    "[dim]Pass --allow-unscanned to merge anyway.[/]"
+                )
+                raise typer.Exit(3) from exc
+            if scan_report.overall == "FAIL":
+                console.print(
+                    f"[red]Backdoor scan FAILED for {escape(adapter_path)}: "
+                    f"{escape(scan_report.summary)}[/]\n"
+                    "[dim]Pass --allow-unscanned to merge anyway "
+                    "(not recommended).[/]"
+                )
+                raise typer.Exit(3)
+            if scan_report.overall == "WARN":
+                console.print(
+                    f"[yellow]Backdoor scan WARN for {escape(adapter_path)}: "
+                    f"{escape(scan_report.summary)} — proceeding.[/]"
+                )
+
+    # v0.60.0 Part E: license-conflict gate. Operators may declare a license
+    # per adapter (--license, repeatable) OR rely on v0.71.2 #187
+    # auto-extraction from adapter_config.json / config.json / model-card
+    # frontmatter. On a conflict, --license-override <reason> proceeds and the
+    # decision is recorded to the audit log (#190).
+    gate_licenses: Optional[list[str]] = None
     if license_ids:
         if len(license_ids) != len(adapters):
             console.print(
@@ -444,8 +490,26 @@ def merge(
                 f"adapter count {len(adapters)}[/]"
             )
             raise typer.Exit(2)
+        gate_licenses = list(license_ids)
+    else:
+        # #187 — auto-detect. Only run the gate if EVERY adapter resolves to a
+        # known license; partial info would make the conflict check misleading.
+        extracted = [extract_license_from_adapter(a) for a in adapters]
+        if all(e is not None for e in extracted):
+            gate_licenses = [str(e) for e in extracted]
+            console.print(
+                "[dim]Auto-detected licenses: "
+                f"{escape(', '.join(gate_licenses))}[/]"
+            )
+        elif license_override is not None:
+            console.print(
+                "[yellow]--license-override given but licenses could not be "
+                "auto-detected for every adapter; no conflict gate triggered.[/]"
+            )
+
+    if gate_licenses is not None:
         try:
-            license_report = check_license_compat(license_ids)
+            license_report = check_license_compat(gate_licenses)
         except (TypeError, ValueError) as exc:
             console.print(f"[red]License check failed: {escape(str(exc))}[/]")
             raise typer.Exit(2) from exc
@@ -467,16 +531,13 @@ def merge(
                     f"[red]Invalid --license-override: {escape(str(exc))}[/]"
                 )
                 raise typer.Exit(2) from exc
+            # #190 — persist the override decision for legal review.
+            record_license_override(gate_licenses, cleared)
             console.print(
                 f"[yellow]License conflict overridden:[/] "
                 f"{escape(license_report.reason)}\n"
-                f"[dim]Reason: {escape(cleared)}[/]"
+                f"[dim]Reason: {escape(cleared)} (recorded to audit log)[/]"
             )
-    elif license_override is not None:
-        console.print(
-            "[yellow]--license-override given without --license declarations; "
-            "no conflict gate triggered.[/]"
-        )
 
     parsed_weights = None
     if weights:
@@ -762,19 +823,32 @@ def sign(
     adapter: str = typer.Argument(..., help="Path to adapter directory"),
     backend: str = typer.Option(
         "unsigned", "--backend",
-        help="Signing backend: unsigned | ed25519 | sigstore (v0.60.0 ships unsigned only)",
+        help="Signing backend: unsigned | ed25519 (sigstore is infra-blocked)",
+    ),
+    key: Optional[str] = typer.Option(
+        None, "--key",
+        help="ed25519 private-key PEM path (or set SOUP_SIGNING_KEY).",
+    ),
+    generate_key: Optional[str] = typer.Option(
+        None, "--generate-key",
+        help="Generate a fresh ed25519 keypair, persist the private key here "
+             "(PEM, 0600), and sign with it.",
     ),
 ):
-    """Compute manifest + write ``.soup-signature.json`` (v0.60.0).
+    """Compute manifest + write ``.soup-signature.json`` (v0.60.0, ed25519 v0.71.2).
 
-    Default backend is ``unsigned`` — provides offline tamper detection
-    via Merkle-root hash. Sigstore + ed25519 backends raise NotImplementedError
-    until v0.60.1.
+    ``unsigned`` (default) gives offline tamper detection via a Merkle-root
+    hash. ``ed25519`` (v0.71.2 #185) adds a real detached signature over that
+    root — pass ``--key <priv.pem>``, set ``SOUP_SIGNING_KEY``, or use
+    ``--generate-key <out.pem>``. ``sigstore`` keyless signing is infra-blocked
+    (needs an OIDC identity provider + Fulcio/Rekor network).
     """
     from soup_cli.utils.adapter_sign import sign_adapter
 
     try:
-        record = sign_adapter(adapter, backend=backend)
+        record = sign_adapter(
+            adapter, backend=backend, key_path=key, generate_key_path=generate_key
+        )
     except FileNotFoundError as exc:
         console.print(f"[red]{escape(str(exc))}[/]")
         raise typer.Exit(1) from exc
@@ -785,6 +859,12 @@ def sign(
         console.print(f"[red]{escape(str(exc))}[/]")
         raise typer.Exit(2) from exc
 
+    if generate_key and record.backend == "ed25519":
+        console.print(
+            f"[yellow]Generated ed25519 private key -> {escape(generate_key)} "
+            "(keep it secret; verify with the matching public key).[/]"
+        )
+
     console.print(
         Panel(
             f"Adapter:    [bold]{escape(record.manifest.adapter)}[/]\n"
@@ -804,8 +884,18 @@ def verify(
         False, "--strict",
         help="Exit 3 on any verification failure (CI-friendly)",
     ),
+    public_key: Optional[str] = typer.Option(
+        None, "--public-key",
+        help="Trusted ed25519 public-key PEM. When set, the embedded signing "
+             "key must match it (genuine authentication, not just consistency).",
+    ),
 ):
-    """Verify ``.soup-signature.json`` against current files (v0.60.0).
+    """Verify ``.soup-signature.json`` against current files (v0.60.0, ed25519 v0.71.2).
+
+    For ``ed25519``-signed adapters the detached signature is verified against
+    the embedded public key (self-consistency); pass ``--public-key
+    <trusted.pem>`` to additionally require the signer's key match a key you
+    trust out of band.
 
     Exit codes:
       0  signature present and matches
@@ -815,10 +905,9 @@ def verify(
     from soup_cli.utils.adapter_sign import verify_adapter
 
     try:
-        if strict:
-            report = verify_adapter(adapter, strict=True)
-        else:
-            report = verify_adapter(adapter, strict=False)
+        report = verify_adapter(
+            adapter, strict=strict, trusted_public_key=public_key
+        )
     except FileNotFoundError as exc:
         console.print(f"[red]{escape(str(exc))}[/]")
         raise typer.Exit(1) from exc