virp-verify 0.1.0 — static verifier and example evidence bundle

Superseded. The verifier now lives in its own repository,
https://github.com/nhowardtli/virp-verify, which is its home going
forward. Use the release there:
virp-verify 0.1.2.

That release fixes what this one could not offer: its source is public, its
binary reproduces byte-for-byte from a tag you can check out
(bf5188681d107ecff09ac91c68449aa74f85b2e978f3766c93043d8508b26985), and its
SHA256SUMS is signed under the current VIRP seal key AD48B20F5D11CED6.
Or just paste the block at the top of the release notes into any Linux
terminal and watch the verdict flip.

This release is left in place unchanged, for anyone holding a copy of its
bytes. Everything below still describes it accurately — including that the
binary here is not reproducibly built and not signed.

---

Static x86_64 Linux verifier, no toolchain required. Includes an example evidence bundle: two producers on one chain, detections bound to the exact segment bytes they ran on.

Run with no arguments and it exits 5, signer trust not established, because the only key available comes from inside the bundle. That is deliberate.

sha256:
virp-verify-0.1.0-linux-musl.tar.gz 3f69a1a7ee1c0854bdd565de055a2eac8043aed2ee9b212ebb28bef113cc6c6c
agent-effect-20260830.tar.gz a8159105bb299164953ea43082ed242c14fb2b220261344098c1eec973c48358

The binary is not reproducibly built and not signed. See RELEASE-NOTES.md in the tarball. The repository is the authoritative source.