# How we verify model files Publisher: The Hugging Bay As of: 2026-11-10 Canonical: https://huggingbay.xyz/verification Every file Hugging Bay serves for download has a SHA-256 computed from the exact bytes we stored. We record it with the file path, size and source in a manifest signed with Ed25519, and each download link re-checks that record before it opens. You can check a downloaded file yourself with one command and compare it with the SHA-256 on the model page. ## Check a file you downloaded - macOS: `shasum -a 256 model.gguf` - Linux: `sha256sum model.gguf` - Windows PowerShell: `Get-FileHash -Algorithm SHA256 .\model.gguf` - Windows Command Prompt: `certutil -hashfile model.gguf SHA256` Compare the result with the SHA-256 listed for that exact file on its model page, or call https://huggingbay.xyz/api/v1/verify?sha256=. ## What we check before we host a file 1. We record where the file came from: the source repository, its revision when the source reports one, and the license label the repository declares. A repository with no license gets the label No license stated. 2. Mirror workers download the file and compare its size with the size the source reports. A mismatch stops the copy. 3. The workers scan samples of the bytes and block risky formats. Raw pickle files (.pkl) are never hosted, and other pickle-based weights (such as .bin and .pt) are hosted only after review. A separate check reads the start of pickle-based files for code that runs when they load. A file that fails is not hosted. 4. We compute the SHA-256 of the bytes we stored and bind it to the storage object, so later changes to that object are detected. 5. The file path, size, SHA-256 and source are written into a manifest signed with Ed25519. The public key is published at /api/keys/manifest-signing. 6. A download button or API link goes through /api/downloads, which re-checks the record and then redirects to a signed link that expires within 300 seconds. ## What a match does not prove A SHA-256 match proves the bytes are unchanged. It does not prove safety, authorship, license permission, quality or hardware fit. ## Questions ### How do I check a model file I downloaded? Compute its SHA-256 on your computer: shasum -a 256 on macOS, sha256sum on Linux, or Get-FileHash -Algorithm SHA256 in Windows PowerShell. Compare the 64-character result with the SHA-256 listed for that exact file on its Hugging Bay model page. If every character matches, you have the same bytes we recorded. You can also paste the hash at huggingbay.xyz/verify or call GET /api/v1/verify?sha256=. ### What does Hugging Bay check before it hosts a file? The source and license label are recorded, the file size is compared with the source, samples of the bytes are scanned, risky pickle formats are blocked or held for review, and the SHA-256 is computed from the stored bytes. The result goes into a manifest signed with Ed25519. Files that fail a check are not hosted. ### Why does the hash on Hugging Face not match my sha256sum output? Hugging Face file pages can show a Xet hash for large files. A Xet hash is a content-addressing hash used by Hugging Face storage, not the SHA-256 of the whole file, so it will not match shasum or sha256sum. Compare with the SHA-256 value instead: on Hugging Face it is listed as SHA256 in the file's pointer details, and on Hugging Bay it is listed next to each hosted file. ### What is a signed manifest? A JSON document that lists each hosted file of a model with its path, size and SHA-256. Hugging Bay signs it with an Ed25519 key. Anyone can fetch the public key from /api/keys/manifest-signing and check the signature, so a changed file list or hash is detectable. ### What is a run receipt? A record that a named file produced a first reply on a named device and runtime, such as the Hugging Bay desktop app on a Mac. Receipts recorded by our own checks are labeled as such. Receipts sent in by users are shown as self-reported and do not change rankings or download decisions. ### Does a hash match mean a model is safe or will run on my computer? No. A SHA-256 match proves the file arrived unchanged, byte for byte. It does not prove who made the model, that it is safe, that its license allows your use, or that it fits your hardware. Read the license label, the source and any run receipts on the model page before use. ### Which models are hosted by Hugging Bay? Most catalog entries describe models hosted elsewhere and link to their source. A hosted file is one Hugging Bay stores and serves itself; only hosted files have a Hugging Bay SHA-256 and download link. ### How can a script or AI agent verify a whole model? Read the per-file SHA-256 values from /api/artifacts//download-plan, download each file, hash it locally and compare. No key is needed. The hosted MCP server at /api/mcp offers the same data and a download-and-verify prompt.