Skip to main content

vulkro update

Refresh - or apply offline - the local CVE bundle, rule packs, and compliance frameworks. Three modes:

  • Public CDN refresh - the default. Fetches a signed bundle from https://dist.vulkro.com/cve/.
  • Verify a bundle - inspect a .vkbundle without applying it.
  • Apply an offline bundle - write a .vkbundle carried in by hand.
  • Author a bundle - internal Vulkro tooling; signs a new bundle with the signing key.

Usage​

vulkro update                                      # public CDN refresh
vulkro update --bundle ./vulkro-cve-<id>.vkbundle # apply offline bundle
vulkro update --verify ./vulkro-cve-<id>.vkbundle # inspect, don't apply
vulkro update --create --out new.vkbundle \
  --add cves:cves/npm.json:./local/npm.json         # author (internal Vulkro tooling)

Flags​

FlagDescription
--bundle <PATH>Apply a .vkbundle against ~/.vulkro/data/.
--verify <PATH>Verify the signature of a bundle and print the manifest, without writing.
--createAuthor a new bundle. Reads the signing key from $VULKRO_SIGNING_KEY (file path or 64-char hex seed).
--out <PATH>Output path for --create.
--add <KIND:TARGET:SOURCE>Bundle entry to include during --create. KIND is cves, rules, or compliance. Repeat per entry.
--trust-key <PATH>Extra trust root (32 raw bytes or hex). Repeatable.
--dest <PATH>Override the destination root for --bundle (default ~/.vulkro/data/).
--no-version-checkSkip the binary-version prompt that runs before the default CVE-refresh flow. Required in CI / non-interactive scripts.

Version-check prompt​

vulkro update is the only command that checks the release feed for a newer binary. No other command does: a plain vulkro scan makes no release-feed request and prints no update notice.

Before refreshing CVE data, the default vulkro update flow performs a fresh check that ignores the 24-hour cache and, if a newer binary is available, prompts:

  ! Update available: 0.5.0 -> 0.5.1
  Run `curl -sSfL https://dist.vulkro.com/install.sh | bash` now? [y/N]

Answer y and the install script runs in place; re-invoke vulkro update once it finishes to pick up fresh CVE data with the new binary. Answer n (or anything else) and the current binary continues straight to the CVE refresh.

The prompt is suppressed when:

  • stdin is not a TTY (so CI pipelines and | cron invocations are never blocked).
  • --no-version-check is passed.
  • VULKRO_NO_UPDATE_CHECK=1 is set in the environment. Because this command is the only thing that checks, that variable now affects only vulkro update.
  • VULKRO_OFFLINE=1 is set (the whole command refuses the network).
  • A specific bundle is being processed (--bundle, --verify, or --create) - those flows are about data, not the binary.

Trust roots​

Bundles are signed with ed25519. Vulkro bakes a list of trusted public keys into the binary at build time. Anything signed by a key outside that list is rejected unless you pass --trust-key <path>.

Rotation policy: a new key is added in a release that also keeps the old key, then the old key is removed in a follow-up release. Existing customers get a window to upgrade before bundles signed by the old key stop verifying.

Air-gap operation​

VULKRO_OFFLINE=1 makes vulkro update (no flags) refuse the network and exit with a hint to use --bundle.

Command reference​

Generated from vulkro help update on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

Refresh the vulnerability data, or apply a signed offline update file.

Apply, verify, or author a signed offline update bundle (.vkbundle). Designed for air-gapped customers who receive new CVE data, rule packs, and compliance frameworks via signed files instead of the public internet.

Exit code: 0 bundle verified / created / applied, or the CVE data was refreshed (or an offered binary upgrade was installed); 2 on a bad argument, a signature / verification failure, or a network / IO error. It never returns 1.

Usage: vulkro update [OPTIONS]

Options:
      --bundle <PATH>
          Path to a .vkbundle to verify and apply against ~/.vulkro/data/

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --verify <PATH>
          Verify the signature of a bundle and print the manifest, without writing anything to disk

      --create
          Author a new bundle. Reads the signing key from $VULKRO_SIGNING_KEY (file path or 64-char hex seed). Pair with --out and one or more --add entries

      --out <PATH>
          Output path for the new bundle

      --add <KIND:TARGET:SOURCE>
          Bundle entry to include during --create. Format: `kind:target/path:source/path` where `kind` is one of `cves`, `rules`, `compliance`. Repeat --add for each file

      --trust-key <PATH>
          Extra trust root (32 raw bytes or hex). Repeat to register many. Used by --bundle and --verify in addition to the keys baked into the binary

      --dest <PATH>
          Override the destination root for `--bundle` (defaults to ~/.vulkro/data/)

      --no-version-check
          Skip the interactive "new vulkro version available - upgrade now?" prompt that runs before the default CVE-refresh flow. Use in CI / scripts where the prompt would block. Also honours `VULKRO_NO_UPDATE_CHECK=1`. This prompt is the only place vulkro checks the release feed: no scan or other command checks for a newer version, so that variable affects `update` and nothing else

  -h, --help
          Print help (see a summary with '-h')
Last updated on