Hash every file in the model folder, not just one weights file. A sharded model has several shard files plus an index file, and all of them are part of the model. Record each SHA256 digest, the index, and the full commit hash in your AI bill of materials.
What a sharded model looks like
Big checkpoints do not fit comfortably in one file. The Transformers guide says that saving a model automatically shards checkpoints larger than 50GB, and the maximum size before sharding can be set. It also creates an index file mapping parameter names to the shard files that hold them. For safetensors that file is named model.safetensors.index.json, and it has two keys: metadata, which stores the total model size, and weight_map, which maps each parameter to its shard file.
Shard names look like model-00001-of-00006.safetensors. Your model is the six shards and the index together, plus config and tokenizer files that the loader reads.
Why one hash is not enough
If you record the digest of only the first shard, an attacker or an accident could change shard four and your record would still say all is well. The index matters too: change the weight_map to point a parameter at a different shard and the files can all be valid while the model behaves differently.
Steps
- Download a pinned revision into an empty folder. Use the full commit hash.
- List every file, including config, tokenizer files and the index.
- Compute a SHA256 digest for each file.
find model_dir -type f -print0 | sort -z | xargs -0 shasum -a 256 > model.sha256
- Compute a digest of the manifest file itself. That single value stands for the whole set.
- Check the index: every shard named in weight_map must exist, and no extra shard files should be present.
- Store the manifest and its digest in your AI BOM entry, next to the repo id, revision, license and source URL.
- At deploy time, recompute and compare before serving.
Where it goes in the record
SPDX 3.0.1 has a verifiedUsing property on AIPackage for integrity methods, and CycloneDX components support hashes. Either way, put the manifest digest at the package level and keep the per file list as an attached file or an evidence record.
| Item | Where to record it |
|---|---|
| Repo id and revision | Name and version fields |
| Per file digests | Attached manifest |
| Manifest digest | Hash field on the model component |
| Index file | Inside the manifest, flagged as an index |
| Date and who verified | Record metadata |
Common problems
- Hub caches use symlinks, so a naive copy can miss files. Resolve the snapshot folder and hash real file contents.
- A model repo can gain files over time. Pinning the revision keeps the file set fixed.
- Quantizing or converting creates a new set of files. Treat that as a new model with its own record.
- Digest checks tell you the files are the ones you approved. They do not tell you the files were safe to approve.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the inventory and notice how every component carries a name, a version and a source. A model record should carry the same fields.
Quick check
Do I need to hash tokenizer and config files?
Yes. They are read by the loader and can change behavior, so they belong in the manifest.
Is SHA256 of the index file enough?
No. The index only names the shards. Hash each shard as well, since a changed shard would not change the index.
Safeguard scans repository dependencies and generates SBOMs. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
