AI model reference not pinned by digest
ID |
model_pinned_by_digest |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Family |
SCM |
Tags |
ai-security, cicd-security, non-reachable, security, spvs15-v4.5.2, supply-chain |
Description
An AI model pulled during pipeline execution is an executable supply-chain artifact. When it is referenced by a mutable tag (or by no version at all), the bytes behind that reference can change between runs — a compromised or silently updated model enters the pipeline with no integrity check.
SPVS v1.5-AI V4.5.2 requires model references to be pinned by cryptographic digest (or equivalent) and unpinned references blocked. For the Hugging Face Hub the "digest or equivalent" pin is a --revision bound to a commit. This detector line-scans the concrete places a pipeline fetches models — Dockerfiles, shell scripts, and CI workflow files (.github/workflows/, .gitlab-ci.yml, azure-pipelines.yml, bitbucket-pipelines.yml, Jenkinsfile) — for huggingface-cli download / hf download commands that carry no --revision, and reports each unpinned fetch. Backslash line-continuations are joined, so a pin on a wrapped line is still recognised.
This covers CLI / pipeline-level model fetches. In-code from_pretrained(…) / snapshot_download(…) calls are source-level (SAST scope), so the absence of a finding is not proof that every model reference is pinned.
|
Security
Pinning a model by commit/digest makes the pipeline reproducible and tamper-evident: the exact model bytes are fixed, and a substitution upstream is detected instead of silently adopted. This is the model-supply-chain analogue of pinning container images by digest or CI actions by commit SHA (OWASP CI/CD Top-10 CICD-SEC-3, Dependency Chain Abuse).