vulkro-sf update

Refreshes the signed vulnerability, rule and compliance data under ~/.vulkro/data/, after offering a newer vulkro-sf binary if one exists.

vulkro-sf update                          # upgrade check, then refresh data
vulkro-sf update --no-version-check       # CI: skip the upgrade prompt
vulkro-sf update --bundle bundle.vkbundle # air-gapped: apply a signed bundle

With no flags it:

1. Checks the vulkro-sf release channel for a newer binary and offers to install it. This is the only command that checks for a newer version: a scan never does.
2. Fetches the latest signed data snapshot, verifies it against the trust roots built into the binary, and applies it.
3. Refreshes the signed Agentforce rules bundle (AP-061 to AP-070) into ~/.vulkro/rules-bundle/. Scans never download it; they use the cached copy or the built-in seed.

vulkro-sf and vulkro share one data store, so updating either refreshes both.

Flag	What it does
--no-version-check	Skip the upgrade prompt. Same as VULKRO_NO_UPDATE_CHECK=1.
--bundle <path>	Verify and apply a .vkbundle delivered out of band.
--verify <path>	Check a bundle's signature and print its manifest, writing nothing.
--dest <path>	Destination for --bundle. Default ~/.vulkro/data/.
--trust-key <path>	Extra trust root for --bundle and --verify. Repeatable.

--create, --out and --add author a new signed bundle (reads the key from VULKRO_SIGNING_KEY).

Air-gapped use

With VULKRO_OFFLINE=1 (or VULKRO_SF_OFFLINE=1) the command refuses the network. Copy a signed bundle across and apply it with --bundle.

Exit codes

Code	Meaning
0	Success.
2	Error (bundle not found, invalid signature, offline without --bundle).

See also: Install