Concepts
Verification
The one rule that makes a download from anywhere safe, and the three ways to apply it.
MarkdownA file you downloaded is only as trustworthy as the host that served it, unless you already knew what its bytes should hash to. The hub gives you that number before you fetch anything.
The rule
Hash what arrives. Keep the file only if its SHA-256 equals the value the index gave you. The expected hash comes from the index and never from the source that served the bytes.
The hub does not verify on read. It cannot: the bytes never pass through it. Verification happens on your machine, or inside a client that does it for you.
Where the expected hash comes from
| Dialect | Field | Source of truth |
|---|---|---|
| Hugging Face Hub API | oid in /api/models/<owner>/<name>/tree/main |
the index |
SHA256SUMS |
one line per file, in sha256sum format |
generated by the hub from the index; never redirected |
| OCI | each layer's digest in the manifest |
the index; a layer is one raw file, so its digest is the file's SHA-256 |
| Ollama | the layer digests Ollama checks itself | the index |
| Objects | files[].sha256 in the model object |
the object, whose own address is the BLAKE3 of its bytes |
The Etag on a /resolve/ redirect is the same SHA-256, quoted. It is a convenience, not a second source: it is copied from the index.
Check one file
curl -sL https://gethologram.ai/hexgrad/Kokoro-82M/resolve/main/EVAL.md -o EVAL.md
echo "9b4d7a54809bf22127d19d936d9e749249e1a655e2e0a1df8a6546f77a819658 EVAL.md" | sha256sum -c
EVAL.md: OK
Check a whole download
Inside the model directory, with no tool of the hub's:
curl -s https://gethologram.ai/hexgrad/Kokoro-82M/resolve/main/SHA256SUMS | sha256sum -c
.gitattributes: OK
DONATE.md: OK
EVAL.md: OK
…
sha256sum -c exits non-zero if any file fails or is missing, so this works as a gate in a script. For a partial download, add --ignore-missing so only the files you have are checked:
curl -s https://gethologram.ai/hexgrad/Kokoro-82M/resolve/main/SHA256SUMS | sha256sum -c --ignore-missing
Clients that check for you
| Client | What it checks | What you do |
|---|---|---|
| Ollama | the SHA-256 of every layer, before the model is usable | nothing |
| oras, modctl, skopeo, crane, containerd | every blob against its digest | nothing |
huggingface_hub |
the size it was told to expect; not the hash | run SHA256SUMS in the snapshot directory |
curl |
nothing | sha256sum -c |
On a mismatch
Drop the file and fetch it again from another source: put /via/ipfs or /via/modelscope in front of the path. The expected hash does not change; only the source does. If every source disagrees with the index, the index is wrong for that file, and the hub wants to know: use POST /api/account/request from a signed-in account, or open an issue on the repository.
Check an object
Objects are addressed by BLAKE3, not SHA-256. The address you asked for must equal the BLAKE3 of the bytes you received. With the blake3 Python package:
curl -s https://gethologram.ai/api/v1/objects/blake3:3cc11e52049117dfc397240fddc7a4d3aa392ded7f623986e4e5757371363d9e -o model.json
python3 -c "from blake3 import blake3; print(blake3(open('model.json','rb').read()).hexdigest())"
3cc11e52049117dfc397240fddc7a4d3aa392ded7f623986e4e5757371363d9e
The Objects page explains what that object is.