Security

A patch is untrusted input until it passes every check. This page collects what the CLI and the registry do to keep it that way, and what they can't promise.

Trust roots

• The first-party Retoque publisher key, c7284ac2fd0b659098d1d7498446b14bba572d2d6e10d96c2e4e20acd41928f1, is pinned in the CLI source.
• More publisher keys can only be added in trustedKeys in your own ~/.config/retoque/config.json. Nothing the registry sends can add a key.
• The registry is not trusted for integrity. Its digests are cross-checked, and any disagreement is a refusal, but acceptance depends only on the publisher signature and the exact bytes it covers.

What a package can't do

• Nothing is executed. There are no install scripts or hooks. The CLI never calls pickle or torch.load on package content and never uses shell=True.
• Only safetensors weights are loaded, with trust_remote_code=False for both the tokenizer and the model.
• Extraction is allowlisted. Only the eight known file names are written, each as a regular file opened with O_EXCL and O_NOFOLLOW. Links, devices, absolute paths, .., duplicates, unknown names, members over 2 GiB and packages over 4 GiB are refused. tarfile.extract is never called.
• Checks happen before anything moves. Everything runs in a private staging directory. The install directory, state.json and the lockfile are written only after every check passes, and installed files are made read-only.
• Base weights are read, never written.

Registry keys

• Keys start with rtq_, are generated server side, and are shown once. Only a keyed hash is stored, so a lost key can't be recovered. Revoke it and create another.
• Each key has scopes: registry:read, artifacts:download, installs:report. A key without the scope a route needs is treated as missing.
• The CLI stores the key in a file with mode 0600 and only sends it over https, or plain http to localhost, 127.0.0.1 or ::1.
• The key is never sent to the download link. A download link is its own single-use credential and expires after five minutes.
• The key can't call a model and isn't a model provider key.

Accounts and sessions

• Sign-in uses one-time email links that expire after 15 minutes. Tokens are stored as HMAC-SHA256 hashes, not in plain text.
• Sessions last 30 days in an HttpOnly, SameSite=Lax cookie, marked Secure when the site runs on https.
• Linking a wallet needs a signature over a message that binds the site, the chain ID, the address, a nonce and a 10-minute expiry. Each nonce works once. A wallet can be linked to only one account per chain.
• Every state change in the workspace writes an audit record.

Datasets

Creator uploads are scanned before they are stored. Files with what look like secrets, such as AWS access keys, private key blocks, sk- style API keys and JSON Web Tokens, are rejected outright. Likely personal data, such as email addresses, phone numbers, valid IBANs and card numbers that pass a Luhn check, needs an explicit acknowledgement. Findings are shown masked. Datasets are kept in private storage outside the web root. See Creator guide.

Serving

If you serve a patch with vLLM, load adapters statically and keep dynamic LoRA endpoints off. See Serving with vLLM.

What verification doesn't promise

• It proves who published a package and that you have the exact bytes they signed. It says nothing about output quality.
• Downloaded weights can't be recalled. Revoking a listing or a license stops new downloads. Copies already on disk keep working.
• --experimental-override installs outside the tested envelope. Expect anything.
• The license contracts haven't had an independent security review yet, which is why they aren't on mainnet.

Reporting a problem

A dedicated security contact is planned and not published yet. If you find a vulnerability in the CLI, the registry or the contracts, don't post the details publicly. Operators can withdraw a version and suspend entitlements while a problem is investigated.