Hugging Face just turned Kernels from a community experiment into a signed, verified, Hub-native format. The revamped Kernels update ships four concrete changes:
- Kernel signing — kernels can now be cryptographically signed, letting downstream users verify provenance before execution
- Trusted kernel publishers — a verification system that surfaces kernels from known, vetted sources
- Improved security — hardened protections around how kernels are handled and distributed
- Hub-native integration — kernels are now first-class Hub objects with full metadata, search discoverability, and version tracking
The core problem: custom GPU kernels scattered across repos with no provenance, no versioning, and no way to verify the code you’re about to run. By making kernels Hub-native with signing and publisher verification, Hugging Face treats them like models and datasets — versioned, attributed, auditable.
NOTE
Kernels now appear in Hub search alongside models and datasets. Publisher trust badges display directly in the kernel card UI.
For teams pulling third-party kernels into inference pipelines, signing and trusted-publisher features are the practical wins. You can pin a kernel to a specific signed version and verify it hasn’t been tampered with — the same workflow you’d expect from a package manager, applied to GPU kernel code.
Available now on the Hub. Existing kernel repos need to opt into signing — unsigned kernels still run but won’t display the verification badge.