A desktop application and CLI for creating verifiable evidence bundles. Extract metadata with pluggable processors, hash deterministically, and anchor proofs via OpenTimestamps.
A native PySide6 interface for building, verifying, and inspecting bundles — alongside the existing CLI workflow.
Metadata extraction is now pluggable. Four seed processors ship in core (markdown, docx, image_exif, pptx) and user processors load from ~/Veribundle/processors/.
The .deb shrank from 216 MB to 90 MB by moving to PySide6-Essentials and dropping QtWebEngine.
Per-file metadata blocks under {processor, values}, with schema_version: 2 for forward compatibility.
PyPI-only dependencies install into ~/Veribundle/.venv/ and apply automatically at launch — no sudo, no system pollution.
Config paths resolve relative to the config file. User files live under ~/Veribundle/. Missing seed processors are re-seeded on every launch.
Create and verify reproducible evidence bundles using the GUI or the CLI.
Install the Debian package on Debian 12 or Ubuntu 24.04. The post-install step prints a getting-started message.
sudo apt install ./veribundle_0.3.0_amd64.debDefine input and output paths along with the bundle name. Relative paths resolve against the config file's own directory.
input_dir: ~/Veribundle/input
output_dir: ~/Veribundle/output
bundle_name: bundleCollect files, run processors to extract metadata, compute SHA256 hashes, generate a deterministic manifest, and anchor a timestamp.
veribundle --config config/example.yaml --build
A deterministic bundle is produced in the configured output directory.
Metadata is grouped per file under {processor, values}.
Recompute hashes and compare against the manifest to validate integrity.
veribundle --config config/example.yaml --verifyVerification produces a binary outcome:
VERIFICATION PASSED
or
VERIFICATION FAILEDEvery file is handled by a processor: a small Python class that reads one file type and returns a dict of metadata. Four seed processors ship in core; more are available from the public veribundle-processors repository.
YAML frontmatter and ATX headings. Zero-dependency example of the processor contract.
Core document metadata via python3-docx.
EXIF and IPTC metadata via python3-pil.
Presentation metadata via python-pptx installed into the user venv. Demonstrates graceful handling of missing dependencies.
Extracts metadata and Microsoft Purview sensitivity labels from password-protected PDFs. Password is passed via config options; the processor refuses to emit output that contains it.
Drop a .py file into ~/Veribundle/processors/. If you need PyPI-only packages, install them into ~/Veribundle/.venv/.
$ veribundle --config config/example.yaml --build
✔ applying user venv
✔ collecting files
✔ running processors
✔ hashing (SHA256)
✔ bundling manifest (schema v2)
✔ anchoring timestamp
Bundle created: ./dist/evidence.vbundle
$ veribundle --config config/example.yaml --verify
✔ recalculating hashes
✔ comparing manifest
VERIFICATION PASSEDBundle files, hashes, and timestamps into a verifiable artifact for legal, investigative, and audit workflows.
Package data and outputs so results can be independently verified and reproduced deterministically.
Ensure artifacts match their source by bundling outputs with manifests for reproducible builds.
Share files with cryptographic integrity guarantees — any modification fails verification.
Maintain traceable integrity records across workflows with deterministic verification outcomes.
Detect corruption and ensure long-term data integrity through reproducible verification checks.
Fully supported. Verified against the full test suite and a manual end-to-end GUI run.
Fully supported. Verified headless and via remote desktop.
Not officially supported. The Python core runs natively; the GUI requires WSLg configuration. Contributions welcome.
Veribundle is open-source. Your contribution will help support ongoing maintenance and future development.