Four bundles, four attacks, kept and prepared for publication. The bundles and their hashes publish with the pinned virp-verify release, so you can run them yourself.
FAILED · exit code 1
An observation body edited after signing.
$ virp-verify bundle-313/ --pin examiner-key.jsonsession autopilot-chainwalk 2 entries entry_hashes VERIFIED entry_signatures VERIFIED session_key_binding VERIFIEDsession burnin-reenabled 3 entries entry_hashes FAILED seq 2: body hash mismatch entry_signatures FAILED seq 2: signature does not cover body session_key_binding VERIFIEDoverall FAILED
FAILED · exit code 1
Signature removed under a signed session head.
$ virp-verify bundle-strip-a-signature/ --pin examiner-key.json(transcript pending — paste the real run)
FAILED · exit code 1
Hashes still verify, signature fails. The checks are independent.
$ virp-verify bundle-corrupt-one-byte-of-a-signature/ --pin examiner-key.json(transcript pending — paste the real run)
UNREADABLE · exit code 2
Key id edited to point elsewhere. The id is re-derived from the key bytes.
$ virp-verify bundle-relabel-the-public-key/ --pin examiner-key.json(transcript pending — paste the real run)