Skip to main content

vulkro cra-bundle

Build a CRA (EU Cyber Resilience Act) readiness bundle: one zip stapling a CycloneDX and SPDX SBOM, an OpenVEX exploitability document, and a compliance evidence pack, with a self-contained CRA-readiness one-pager index. Every artifact is built from your local scan data and the bundled CVE database; nothing is uploaded.

Framed as readiness evidence, not a conformance attestation.

Usage​

vulkro cra-bundle [PATH] --framework soc2 -o cra-readiness.zip
ArgumentDescriptionDefault
PATHPath to the project root..

Flags​

FlagDescriptionDefault
--framework <FRAMEWORK>Framework for the bundled compliance evidence pack.soc2
--output, -o <OUTPUT>Output zip path../cra-readiness.zip

Framework values: soc2, iso27001, hipaa, pci-dss-4-0, nist-800-53, soc2-full. (Salesforce-specific frameworks such as cis-sf, hitrust, fedramp-moderate, nist-800-171, stateramp, and sox-itgc are also accepted and are documented under the Salesforce section.)

Exit codes​

  • 0 bundle written, no findings.
  • 1 bundle written, findings present.
  • 2 scan or IO error.

Example​

vulkro cra-bundle . --framework iso27001 -o cra-readiness.zip

Command reference​

Generated from vulkro help cra-bundle on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Build an EU Cyber Resilience Act readiness bundle: package list, exploitability statements and evidence.

[Pro] Build a CRA (EU Cyber Resilience Act) readiness bundle: one zip stapling a CycloneDX + SPDX SBOM, an OpenVEX exploitability document, and a compliance evidence pack, with a self-contained CRA-readiness one-pager index. The whole bundle is built locally: your source, component list, and findings never leave the machine. Framed as readiness evidence, not a conformance attestation.

Exit codes: `0` bundle written, no findings; `1` bundle written, findings present; `2` scan / IO error.

Usage: vulkro cra-bundle [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the project root (default: current directory)
          
          [default: .]

Options:
      --framework <FRAMEWORK>
          Framework for the bundled compliance evidence pack. One of: soc2 / iso27001 / hipaa / pci-dss-4-0 / nist-800-53 / soc2-full

          Possible values:
          - soc2
          - iso27001
          - hipaa
          - pci-dss-4-0
          - nist-800-53
          - soc2-full
          - cis-sf:           CIS Salesforce Benchmark v1.2.0. Salesforce-specific deep compliance pack; see `src/security/compliance_frameworks/cis_salesforce.rs`
          - hitrust:          HITRUST CSF v11.2.0. Salesforce Health Cloud compliance pack (HIPAA + HITECH + ISO 27001/27002 + NIST CsF harmonised); see `src/security/compliance_frameworks/hitrust_csf.rs`
          - fedramp-moderate: FedRAMP Moderate (Rev 5 Baseline, May 2023). Federal Salesforce compliance pack covering the 14 NIST 800-53 families that apply to a tenant-controllable Government Cloud Plus deployment. Accepts both `fedramp-moderate` and the shorter `fedramp` alias. See `src/security/compliance_frameworks/fedramp_moderate.rs`
          - nist-800-171:     NIST SP 800-171 Rev. 2. Salesforce defence-contractor compliance pack (DFARS 252.204-7012 / CMMC Level 2); see `src/security/compliance_frameworks/nist_800_171.rs`
          - stateramp:        StateRAMP Moderate (Baseline 2024.05). State and municipal government Salesforce compliance pack. Shares its NIST 800-53 lineage with FedRAMP Moderate plus four state-government distinct rows. Accepts both `stateramp` and the longer `stateramp-moderate` alias. See `src/security/compliance_frameworks/stateramp_moderate.rs`
          - sox-itgc:         SOX IT General Controls (COBIT 2019 Baseline). Salesforce financial-services compliance pack covering the three ITGC families (Access Controls, Change Management, IT Operations); see `src/security/compliance_frameworks/sox_itgc.rs`
          
          [default: soc2]

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

  -o, --output <OUTPUT>
          Output zip path
          
          [default: ./cra-readiness.zip]

  -h, --help
          Print help (see a summary with '-h')
Last updated on