Bundle format

A .vkbundle is a signed file that carries CVE data, rule packs and compliance frameworks to a machine with no network.

vulkro update --verify ./vulkro-cve-2026-05-10.vkbundle   # check it, write nothing
vulkro update --bundle ./vulkro-cve-2026-05-10.vkbundle   # check it and apply it

We build and sign each bundle. Ask license@vulkro.com for one; you only verify and apply it.

Layout

A gzipped tar archive:

vulkro-cve-2026-05-10.vkbundle
+-- manifest.json          metadata and a SHA-256 for every file
+-- manifest.json.sig      Ed25519 signature over manifest.json
+-- data/
    +-- cves/*.json        one file per ecosystem (npm, pypi, cargo, go, maven)
    +-- rules/*.yaml       rule packs (optional)
    +-- compliance/*.toml  compliance frameworks (optional)

manifest.json

{
  "schema_version": 1,
  "snapshot_id": "2026-05-10",
  "created_at": "2026-05-10T05:17:00Z",
  "ecosystems": ["npm", "PyPI", "Cargo", "Go"],
  "record_counts": { "npm": 31420, "PyPI": 18901, "Cargo": 4203, "Go": 7144 },
  "files": [
    { "path": "data/cves/npm.json", "sha256": "...", "bytes": 18923844 }
  ],
  "signing_key_id": "vulkro-cve-signing"
}

What --bundle checks

1. The signature on manifest.json, against the keys built into the binary plus any --trust-key you pass.
2. The SHA-256 of every file against the manifest.
3. Only then does it write: files are staged in a temporary directory and swapped into ~/.vulkro/data/ in one step (--dest picks another directory).

Any failure stops before the swap, so the data directory is never left half-updated. --verify runs the same checks and prints the manifest without writing anything.

Exit code	Meaning
0	Verified (and applied, with --bundle)
2	Bad argument, signature or hash failure, or IO error

See also: Signing and trust roots, Offline mode.