vulkro update

Refreshes the local CVE data, rule packs and compliance frameworks, or applies a signed offline bundle on an air-gapped machine.

vulkro update                                      # download the latest signed data
vulkro update --verify ./vulkro-cve-<id>.vkbundle  # check a bundle, write nothing
vulkro update --bundle ./vulkro-cve-<id>.vkbundle  # apply it offline

Flags

Flag	Description
--bundle <PATH>	Verify and apply a .vkbundle to ~/.vulkro/data/.
--verify <PATH>	Check a bundle's signature and print its manifest.
--dest <PATH>	Apply --bundle somewhere other than ~/.vulkro/data/.
--trust-key <PATH>	An extra trusted public key. Repeatable.
--no-version-check	Skip the "newer version available" prompt. Use in scripts.

--create, --out and --add build a new signed bundle; they are for our own release tooling.

Version check

vulkro update is the only command that checks for a newer Vulkro release. If one exists, it offers to install it before refreshing the data. The prompt is skipped when stdin is not a terminal, with --no-version-check or VULKRO_NO_UPDATE_CHECK=1, and when applying, verifying or creating a bundle.

Offline

Bundles are signed with ed25519 and checked against keys built into the binary (plus any --trust-key). With VULKRO_OFFLINE=1, a plain vulkro update refuses the network and points you to --bundle.

Exit codes

0 data refreshed, or a bundle verified or applied. 2 bad argument, signature failure, or network or IO error. It never returns 1.

See also: Bundle format, Signing and trust roots.