veritensor 1.9.1__tar.gz → 1.9.3__tar.gz

{veritensor-1.9.1/src/veritensor.egg-info → veritensor-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veritensor
-Version: 1.9.1
+Version: 1.9.3
 Summary: Antivirus for the AI Supply Chain. Scans models, datasets, notebooks, and RAG documents for threats.
 Author-email: Arsenii Brazhnyk <veritensor@gmail.com>
 License: Apache-2.0
@@ -28,13 +28,16 @@ Requires-Dist: pyyaml>=6.0
 Requires-Dist: huggingface_hub>=0.19.0
 Requires-Dist: cyclonedx-python-lib>=6.0.0
 Requires-Dist: jinja2>=3.1.0
-Requires-Dist: pillow>=12.2.0
+Requires-Dist: pillow>=12.3.0
 Requires-Dist: lxml>=6.1.0
 Requires-Dist: urllib3>=2.7.0
-Requires-Dist: gitpython>=3.1.49
+Requires-Dist: gitpython>=3.1.54
 Requires-Dist: pyarrow>=14.0.0
 Requires-Dist: pandas>=2.0.0
 Requires-Dist: openpyxl>=3.1.0
+Requires-Dist: defusedxml>=0.7.1
+Requires-Dist: tomli>=2.0.0; python_version < "3.11"
+Requires-Dist: msgpack>=1.2.1
 Provides-Extra: test
 Requires-Dist: pytest>=7.0.0; extra == "test"
 Requires-Dist: pytest-mock>=3.10.0; extra == "test"
@@ -46,14 +49,14 @@ Provides-Extra: pii
 Requires-Dist: presidio-analyzer>=2.2.0; extra == "pii"
 Requires-Dist: spacy>=3.0.0; extra == "pii"
 Provides-Extra: rag
-Requires-Dist: pypdf>=4.0.0; extra == "rag"
+Requires-Dist: pypdf>=6.14.2; extra == "rag"
 Requires-Dist: python-docx>=1.1.0; extra == "rag"
 Requires-Dist: python-pptx>=0.6.21; extra == "rag"
 Requires-Dist: veritensor[pii]; extra == "rag"
 Provides-Extra: aws
 Requires-Dist: boto3>=1.28.0; extra == "aws"
 Provides-Extra: all
-Requires-Dist: veritensor[aws,data,pii,rag]; extra == "all"
+Requires-Dist: veritensor[aws,pii,rag]; extra == "all"
 Provides-Extra: dev
 Requires-Dist: veritensor[all,test]; extra == "dev"
 Requires-Dist: black; extra == "dev"
@@ -395,32 +398,6 @@ veritensor scan ./models \
     --sarif --output-file report.sarif \
     --json --output-file results.json
 ```
----
-
-## 🔐 Supply Chain Security (Container Signing)
-
-Veritensor integrates with Sigstore Cosign to cryptographically sign your Docker images only if they pass the security scan.
-
-### 1. Generate Keys
-Generate a key pair for signing:
-```bash
-veritensor keygen
-# Output: veritensor.key (Private) and veritensor.pub (Public)
-```
-### 2. Scan & Sign
-Pass the --image flag and the path to your private key (via env var).
-```bash
-# Set path to your private key
-export VERITENSOR_PRIVATE_KEY_PATH=veritensor.key
-
-# If scan passes -> Sign the image
-veritensor scan ./models/my_model.pkl --image my-org/my-app:v1.0.0
-```
-### 3. Verify (In Kubernetes / Production)
-Before deploying, verify the signature to ensure the model was scanned:
-```bash
-cosign verify --key veritensor.pub my-org/my-app:v1.0.0
-```
 
 ---
 
@@ -443,7 +420,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Veritensor Scan
-        uses: arsbr/Veritensor@v1.9.1
+        uses: arsbr/Veritensor@v1.9.3
         with:
           path: '.'
           jobs: '4'
@@ -454,7 +431,7 @@ Prevent committing malicious models to your repository. Add this to .pre-commit-
 ```yaml
 repos:
   - repo: https://github.com/arsbr/Veritensor
-    rev: v1.9.1
+    rev: v1.9.3
     hooks:
       - id: veritensor-scan
 ```

{veritensor-1.9.1 → veritensor-1.9.3}/README.md

@@ -333,32 +333,6 @@ veritensor scan ./models \
     --sarif --output-file report.sarif \
     --json --output-file results.json
 ```
----
-
-## 🔐 Supply Chain Security (Container Signing)
-
-Veritensor integrates with Sigstore Cosign to cryptographically sign your Docker images only if they pass the security scan.
-
-### 1. Generate Keys
-Generate a key pair for signing:
-```bash
-veritensor keygen
-# Output: veritensor.key (Private) and veritensor.pub (Public)
-```
-### 2. Scan & Sign
-Pass the --image flag and the path to your private key (via env var).
-```bash
-# Set path to your private key
-export VERITENSOR_PRIVATE_KEY_PATH=veritensor.key
-
-# If scan passes -> Sign the image
-veritensor scan ./models/my_model.pkl --image my-org/my-app:v1.0.0
-```
-### 3. Verify (In Kubernetes / Production)
-Before deploying, verify the signature to ensure the model was scanned:
-```bash
-cosign verify --key veritensor.pub my-org/my-app:v1.0.0
-```
 
 ---
 
@@ -381,7 +355,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Veritensor Scan
-        uses: arsbr/Veritensor@v1.9.1
+        uses: arsbr/Veritensor@v1.9.3
         with:
           path: '.'
           jobs: '4'
@@ -392,7 +366,7 @@ Prevent committing malicious models to your repository. Add this to .pre-commit-
 ```yaml
 repos:
   - repo: https://github.com/arsbr/Veritensor
-    rev: v1.9.1
+    rev: v1.9.3
     hooks:
       - id: veritensor-scan
 ```

{veritensor-1.9.1 → veritensor-1.9.3}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["setuptools>=61.0"]
+requires = ["setuptools>=78.1.1", "wheel>=0.46.2"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "veritensor"
-version = "1.9.1"
+version = "1.9.3"
 description = "Antivirus for the AI Supply Chain. Scans models, datasets, notebooks, and RAG documents for threats."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -33,14 +33,16 @@ dependencies = [
     "huggingface_hub>=0.19.0",
     "cyclonedx-python-lib>=6.0.0",
     "jinja2>=3.1.0",
-    "pillow>=12.2.0",
+    "pillow>=12.3.0",
     "lxml>=6.1.0",
     "urllib3 >= 2.7.0",
-    # Fickling removed from here to avoid installing PyTorch (800MB+) for regular users
-    "gitpython>=3.1.49",
+    "gitpython>=3.1.54",
     "pyarrow>=14.0.0",
     "pandas>=2.0.0",
     "openpyxl>=3.1.0",
+    "defusedxml>=0.7.1",
+    "tomli>=2.0.0; python_version < '3.11'",
+    "msgpack>=1.2.1",
 ]
 
 
@@ -63,7 +65,7 @@ pii = [
 
 # Optional dependencies for RAG document scanning (PDF, DOCX)
 rag = [
-    "pypdf>=4.0.0",
+    "pypdf>=6.14.2",
     "python-docx>=1.1.0",
     "python-pptx>=0.6.21",
     "veritensor[pii]"
@@ -75,7 +77,7 @@ aws = [
 ]
 
 all = [
-    "veritensor[aws,data,rag,pii]"
+    "veritensor[aws,rag,pii]"
 ]
 
 dev = [

veritensor-1.9.3/src/veritensor/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "1.9.3"
+

{veritensor-1.9.1 → veritensor-1.9.3}/src/veritensor/cli/main.py

@@ -11,6 +11,7 @@ import os
 import datetime
 import time
 import requests
+import copy
 import fnmatch
 import concurrent.futures
 import multiprocessing
@@ -60,7 +61,6 @@ except ImportError:
     from veritensor.engines.static.rules import is_license_restricted
     def is_match(repo, allowed): return False
 
-from veritensor.integrations.cosign import sign_container, is_cosign_available, generate_key_pair
 from veritensor.integrations.huggingface import HuggingFaceClient
 
 logging.basicConfig(level=logging.INFO, format="%(message)s")
@@ -109,7 +109,7 @@ HEAVY_EXTS = {
             # --- AI Notebooks (AST, Secrets, Outputs) ---
             ".ipynb",
 
-            # --- Datasets (Сэмплируются перед отправкой!) ---
+            # --- Datasets (sampled before upload to reduce payload size!) ---
             ".parquet", ".csv", ".tsv", ".jsonl", ".ndjson",
 
             # --- Text & Markup (DeBERTa Semantic Scan, GLiNER) ---
@@ -131,6 +131,22 @@ HEAVY_EXTS = {
         # Specific files that are sent to the server (name verification)
 HEAVY_FILES = {"dockerfile"}
 
+def _build_api_url(report_url: str, endpoint: str) -> str:
+    """
+    Safely constructs API endpoint URL.
+    Expected input formats:
+      - http://server/api/v1
+      - http://server/api/v1/telemetry
+    """
+    if not report_url:
+        return ""
+    base = report_url.rstrip("/")
+    for suffix in ("/api/v1/telemetry", "/telemetry", "/api/v1"):
+        if base.endswith(suffix):
+            base = base[: -len(suffix)]
+            break
+            
+    return f"{base.rstrip('/')}/api/v1{endpoint}"
 
 def load_ignore_patterns(ignore_file: str = ".veritensorignore") -> List[str]:
     """Loads glob patterns from .veritensorignore file."""
@@ -166,7 +182,7 @@ def check_remote_cache(report_url: str, api_key: str, hashes: List[str], version
     if not report_url or not api_key or not hashes:
         return {}
     
-    cache_url = report_url.replace("/telemetry", "/cache/check")
+    cache_url = _build_api_url(report_url, "/cache/check")
     headers = {"X-API-Key": api_key}
     payload = {"hashes": hashes, "scanner_version": version} # Added a version to the payload
     
@@ -183,7 +199,7 @@ def fetch_server_policies(report_url: str, api_key: str) -> Tuple[Optional[dict]
     if not report_url or not api_key:
         return None,[]
     
-    policy_url = report_url.replace("/telemetry", "/policies")
+    policy_url = _build_api_url(report_url, "/policies")
     headers = {"X-API-Key": api_key}
     
     try:
@@ -204,7 +220,8 @@ def is_suppressed(file_path: str, threat_msg: str, suppressions: List[dict]) ->
         if not supp_path or not supp_type:
             continue
         file_name = Path(file_path).name
-        if file_name == supp_path and supp_type in threat_msg:
+        supp_name = Path(supp_path).name
+        if file_name == supp_name and supp_type in threat_msg:
             return True
     return False
 
@@ -239,6 +256,16 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
     scan_res = ScanResult(file_path=file_path_str)
     scan_res.repo_id = repo 
 
+    # Check MCP config files early, before extension-based routing swallows .json files
+    if file_path and ext == ".json" and not is_s3:
+        try:
+            if is_mcp_config_file(file_path):
+                perm_result = audit_mcp_config(file_path)
+                for t in perm_result.to_threat_strings():
+                    scan_res.add_threat(t)
+        except Exception as e:
+            logger.debug(f"MCP Audit failed for {file_name}: {e}")
+
     # --- HYBRID ROUTING (Sending heavy files to the server) ---
     # If the user has an Enterprise server connected
     already_remote_scanned = False
@@ -252,12 +279,28 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
                 scanner = EnterpriseScanner(config.report_url, config.api_key)
                 remote_threats = scanner.scan_file_remotely(file_path, full_scan=full_scan_dataset)
                 
-                if remote_threats:
-                    for t in remote_threats: scan_res.add_threat(t)
+                # Detect network/timeout failures by inspecting returned warnings
+                _INFRA_FAILURE_PREFIXES = (
+                    "WARNING: Failed to reach",
+                    "WARNING: Enterprise scan timed out",
+                    "WARNING: S3",
+                )
+                is_infra_failure = any(
+                    t.startswith(_INFRA_FAILURE_PREFIXES) for t in remote_threats
+                ) if remote_threats else False
                 
-                already_remote_scanned = True    
-                # The file has been verified on the server (ML, OCR, YARA), so we skip the local checks
-                #return scan_res
+                if is_infra_failure:
+                    # Infrastructure failure: do NOT set already_remote_scanned
+                    # so local fallback can run for supported formats
+                    logger.warning(f"Remote scan unavailable for {file_name}. Falling back to local scan.")
+                    for t in remote_threats:
+                        scan_res.threats.append(t)  # Append without triggering immediate FAIL status
+                else:
+                    if remote_threats:
+                        for t in remote_threats: 
+                            scan_res.add_threat(t)
+                    already_remote_scanned = True    
+                    
             except Exception as e:
                 scan_res.add_threat(f"WARNING: Remote scan failed, falling back to local: {e}")
 
@@ -318,8 +361,7 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
                     try:
             
                         safe_filename = quote(file_name, safe='')
-                        prof_url = config.report_url.replace("/telemetry", f"/fairness/profiles/{safe_filename}")
-                        
+                        prof_url = _build_api_url(config.report_url, f"/fairness/profiles/{safe_filename}")
                         res = requests.get(prof_url, headers={"X-API-Key": config.api_key}, timeout=5)
                         if res.status_code == 200:
                             bias_profile = res.json().get("profile")
@@ -330,8 +372,9 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
                 # Pass the profile to the scanner
                 threats, bias_data = scan_dataset(file_path, full_scan=full_scan_dataset, bias_profile=bias_profile)
                 
-                for t in threats: 
-                    scan_res.add_threat(t)
+                if not already_remote_scanned:
+                    for t in threats: 
+                        scan_res.add_threat(t)
                     
                 # Attach bias data to the result so it gets sent in telemetry
                 if bias_data:
@@ -360,12 +403,7 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
                 if mcp_result.mcp_tools_found:
                     for t in mcp_result.to_threat_strings():
                         scan_res.add_threat(t)
-            elif ext == ".json" and file_path:
-                if is_mcp_config_file(file_path):
-                    from veritensor.engines.static.mcp_permission_auditor import audit_mcp_config
-                    perm_result = audit_mcp_config(file_path)
-                    for t in perm_result.to_threat_strings():
-                        scan_res.add_threat(t)
+          
         else:
             # If the format is unknown to any engine at all.
             # We add INFO, but DO NOT call add_threat(),
@@ -379,11 +417,6 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
     except Exception as e:
         scan_res.add_threat(f"CRITICAL: Engine Error: {str(e)}")
 
-    # --- MERGE REMOTE THREATS ---
-    for t in remote_threats:
-        if t not in scan_res.threats:
-            scan_res.add_threat(t)
-
     # --- C. License Check ---
     if not is_s3 and file_path:
         reader = get_reader_for_file(file_path)
@@ -414,6 +447,11 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
 
     return scan_res
 
+def _worker_initializer():
+    """Pre-load spaCy model once per worker process to avoid RAM spikes during scans."""
+    from veritensor.engines.content.pii import PIIScanner
+    PIIScanner.get_engine()
+    
 # --- SHARED SCAN LOGIC ---
 def _run_scan_process(
     paths: List[str], repo: Optional[str], jobs: Optional[int], 
@@ -424,8 +462,8 @@ def _run_scan_process(
     Core logic to collect files and run parallel scan.
     Used by both 'scan' and 'manifest' commands.
     """
-    files_to_scan =[]
-    ignore_patterns = load_ignore_patterns() # Load .veritensorignore
+    files_to_scan: List[str] = []
+    ignore_patterns = load_ignore_patterns() 
     
     # 1. Collect Files from all paths
     for path in paths:
@@ -436,11 +474,11 @@ def _run_scan_process(
             local_path = Path(path)
             if local_path.is_file():
                 if not is_ignored(local_path, ignore_patterns):
-                    files_to_scan.append(local_path)
+                    files_to_scan.append(str(local_path))
             elif local_path.is_dir():
                 for p in local_path.rglob("*"):
                     if p.is_file() and not is_ignored(p, ignore_patterns):
-                        files_to_scan.append(p)
+                        files_to_scan.append(str(p))
             else:
                 raise FileNotFoundError(f"Path {path} not found.")
 
@@ -460,21 +498,16 @@ def _run_scan_process(
     tasks = []
     
     # First, we quickly calculate the hashes locally (using SQLite so as not to read the files again)
-    local_hashes_map = {} # {filepath: hash}
+    local_hashes_map = {} 
+    
     for f in files_to_scan:
-        if str(f).startswith("s3://"):
+        if f.startswith("s3://"):
             continue
-        cached_hash = hash_cache.get(f)
+            
+        file_path_obj = Path(f)
+        cached_hash = hash_cache.get(file_path_obj)
         if cached_hash:
-            local_hashes_map[str(f)] = cached_hash
-        else:
-            # If there is no local cache, you will have to calculate
-            try:
-                h = calculate_sha256(f)
-                local_hashes_map[str(f)] = h
-                hash_cache.set(f, h)
-            except Exception:
-                pass
+            local_hashes_map[f] = cached_hash
 
     # We ask the server about these hashes
     remote_cache_results = {}
@@ -486,17 +519,17 @@ def _run_scan_process(
 
     # Creating tasks
     for f in files_to_scan:
-        is_s3 = str(f).startswith("s3://")
+        is_s3 = f.startswith("s3://")
         if is_s3:
-            tasks.append((str(f), config, repo, ignore_license, full_scan, True, None))
+            tasks.append((f, config, repo, ignore_license, full_scan, True, None))
             continue
             
-        file_hash = local_hashes_map.get(str(f))
+        file_hash = local_hashes_map.get(f)
         
         # If the server knows this file, we DON'T add it to tasks
         if file_hash and file_hash in remote_cache_results:
             remote_data = remote_cache_results[file_hash]
-            res = ScanResult(file_path=str(f), status=remote_data["status"], file_hash=file_hash)
+            res = ScanResult(file_path=f, status=remote_data["status"], file_hash=file_hash)
             res.threats = remote_data["threats"]
 
             reader = get_reader_for_file(Path(f))
@@ -509,7 +542,7 @@ def _run_scan_process(
                 
             results.append(res) 
         else:
-            tasks.append((str(f), config, repo, ignore_license, full_scan, False, file_hash))
+            tasks.append((f, config, repo, ignore_license, full_scan, False, file_hash))
 
     # 3. Execute
     executor = None
@@ -527,7 +560,10 @@ def _run_scan_process(
         ) as progress:
             
             main_task = progress.add_task("Scanning...", total=len(tasks))
-            executor = concurrent.futures.ProcessPoolExecutor(max_workers=jobs)
+            executor = concurrent.futures.ProcessPoolExecutor(
+                max_workers=jobs,
+                initializer=_worker_initializer
+            )
             
             future_to_file = {
                 executor.submit(scan_worker, task_args): task_args[0] 
@@ -563,7 +599,6 @@ def _run_scan_process(
 def scan(
     paths: List[str] = typer.Argument(..., help="Paths to files, directories, or S3 URLs"),
     repo: Optional[str] = typer.Option(None, "--repo", "-r", help="Hugging Face Repo ID"),
-    image: Optional[str] = typer.Option(None, help="Docker image tag to sign"),
     ignore_license: bool = typer.Option(False, "--ignore-license", help="Do not fail on license violations"),
     ignore_malware: bool = typer.Option(False, "--ignore-malware", help="Do not fail on malware/policy violations"),
     full_scan: bool = typer.Option(False, "--full-scan", help="Scan entire dataset (slow)."),
@@ -583,14 +618,14 @@ def scan(
     watch: bool = typer.Option(False, "--watch", "-w", help="Watch files for changes and scan automatically"),
 
 ):
-    """
-    Scans models, data, and code for security threats.
-    """
-    config = ConfigLoader.load()
+    """Scans models, data, and code for security threats."""
+    # Work on a shallow copy to prevent mutating the singleton between runs
+    base_config = ConfigLoader.load()
+    config = copy.copy(base_config)
+    
     if verbose: logger.setLevel(logging.DEBUG)
     is_machine_output = (json_output or sarif_output or sbom_output) and not output_file
     
-    # Passing the flags from the console to the global config object
     config.report_url = report_to or config.report_url
     config.api_key = api_key or config.api_key
     
@@ -601,7 +636,7 @@ def scan(
             try:
                 with open(policy_path, "r") as f:
                     yaml_content = f.read()
-                sync_url = config.report_url.replace("/telemetry", "/policies/sync")
+                sync_url = _build_api_url(config.report_url, "/policies/sync")
                 res = requests.post(sync_url, headers={"X-API-Key": config.api_key}, json={"yaml_content": yaml_content})
                 if res.status_code == 200:
                     console.print("[bold green]✅ Policy-as-Code successfully synced to Control Plane.[/bold green]")
@@ -637,7 +672,6 @@ def scan(
         console.print(Panel.fit(f"🛡️  [bold cyan]Veritensor Security Scanner[/bold cyan] v{__version__}", border_style="cyan"))
 
     if watch:
-        import time
         console.print("[bold cyan]👀 Veritensor Watcher started. Monitoring files for changes... (Press Ctrl+C to stop)[/bold cyan]")
         
         # Collecting the initial file modification dates
@@ -724,6 +758,8 @@ def scan(
         
         if blocking_threats:
             res.status = "FAIL"
+        elif any(t.startswith("WARNING: Failed to reach") or t.startswith("WARNING: Enterprise scan timed out") for t in real_threats):
+            res.status = "SCAN_ERROR"
         else:
             res.status = "PASS"
             
@@ -742,8 +778,9 @@ def scan(
             if not res.threats: continue
             
             artifact_name = Path(res.file_path).name
+            safe_artifact_name = quote(artifact_name, safe='')
             fingerprint_param = f"?fingerprint={res.file_hash}" if res.file_hash else ""
-            baseline_url = config.report_url.replace("/telemetry", f"/scans/{artifact_name}/baseline{fingerprint_param}")
+            baseline_url = _build_api_url(config.report_url, f"/scans/{safe_artifact_name}/baseline{fingerprint_param}")
             
             try:
                 b_res = requests.get(baseline_url, headers={"X-API-Key": config.api_key}, timeout=60)
@@ -816,11 +853,11 @@ def scan(
 
     machine_text = None        
     if sarif_output:
-        machine_text = generate_sarif_report(results)
+        machine_text = generate_sarif_report(filtered_results)
     elif sbom_output:
-        machine_text = generate_sbom(results)
+        machine_text = generate_sbom(filtered_results)
     elif json_output:
-        results_dicts = [r.__dict__ for r in results]
+        results_dicts = [r.__dict__ for r in filtered_results]
         machine_text = json.dumps(results_dicts, indent=2)
 
     if machine_text:
@@ -882,11 +919,6 @@ def scan(
     else:
         if not is_machine_output: console.print("\n[bold green]✅ Scan Passed.[/bold green]")
 
-    if image:
-        scan_timestamp = datetime.datetime.now(datetime.timezone.utc).isoformat()
-        _perform_signing(image, sign_status, config, scan_timestamp, results)
-
-
 @app.command()
 def manifest(
     paths: List[str] = typer.Argument(..., help="Paths to scan"), 
@@ -921,34 +953,12 @@ def _print_table(results: List[ScanResult]):
         else:
             unique_threats = list(dict.fromkeys(res.threats))
             display_threats = "\n".join(unique_threats)
-        table.add_row(res.file_path.split("/")[-1], f"[{status_style}]{res.status}[/{status_style}]", display_threats)
+            
+        # Use Path.name for cross-platform compatibility
+        file_name = Path(res.file_path).name if res.file_path else "unknown"
+        table.add_row(file_name, f"[{status_style}]{res.status}[/{status_style}]", display_threats)
     console.print(table)
 
-def _perform_signing(image: str, status: str, config, timestamp: str, results: List[ScanResult]):
-    console.print(f"\n🔐 [bold]Signing container:[/bold] {image}")
-    key_path = config.private_key_path or os.environ.get("VERITENSOR_PRIVATE_KEY_PATH")
-    if not key_path:
-         console.print("[red]Skipping signing: No private key found.[/red]")
-         return
-    annotations = {"scanned_by": "veritensor", "status": status, "scan_date": timestamp}
-    if results:
-        primary = results[0]
-        if primary.file_hash: annotations["ai.model.hash"] = primary.file_hash
-        if primary.detected_license: annotations["ai.model.license"] = primary.detected_license
-        if primary.repo_id: annotations["ai.model.source"] = primary.repo_id
-    success = sign_container(image, key_path, annotations=annotations)
-    if success: console.print(f"[green]✔ Signed with Smart Attestation.[/green]")
-    else: console.print(f"[bold red]Signing Failed.[/bold red]")
-
-@app.command()
-def keygen(output_prefix: str = "veritensor"):
-    console.print(f"[bold]Generating Cosign Key Pair ({output_prefix})...[/bold]")
-    if not is_cosign_available():
-        console.print("[bold red]Error:[/bold red] 'cosign' binary not found.")
-        raise typer.Exit(code=1)
-    if generate_key_pair(output_prefix): console.print(f"[green]✔ Keys generated.[/green]")
-    else: console.print("[red]Key generation failed.[/red]")
-
 @app.command()
 def update():
     SIG_URL = "https://raw.githubusercontent.com/arsbr/Veritensor/main/src/veritensor/engines/static/signatures.yaml"