Signing & trust roots

Every CVE bundle, rule pack and compliance framework Vulkro reads is signed with Ed25519 and checked against public keys built into the binary.

vulkro update --bundle ./internal.vkbundle --trust-key ~/.vulkro/internal.pub

The trust list

The binary carries a short list of Ed25519 public keys. A bundle whose signature does not match one of them is refused. There is no "trust on first use" and no "warn but allow".

Add your own key

If you mirror Vulkro data and re-sign it internally, pass your public key with --trust-key (to vulkro update --bundle or --verify). The file holds 32 raw bytes or a 64-character hex string. Repeat the flag for more keys. Your keys are added to the built-in list; they never replace it.

To sign your own bundle:

VULKRO_SIGNING_KEY=./internal.key vulkro update --create \
  --out ./internal.vkbundle \
  --add cves:data/cves/npm.json:./npm.json

--add takes kind:target:source, where kind is cves, rules or compliance. VULKRO_SIGNING_KEY is a file path or a 64-character hex seed.

How we sign

1. Our bundler collects advisory data (OSV, NVD, CISA KEV, EPSS) into a .vkbundle.
2. It is signed on our build machine. The production signing key never leaves it.
3. The signed bundle is published to dist.vulkro.com.
4. Your binary verifies it against its built-in keys before use.

Key rotation

Release	Trusted keys	Bundles signed with
N	old and new	old or new
N+1	old and new	new only
N+2 (months later)	new	new

A binary from release N or later keeps applying new bundles. There is no revocation list: the trust list lives in the binary, so rotation is the recovery path.

See also: Bundle format, Offline mode.