Updating Draugr & tools

Keep Draugr and its scanners current with two verified, opt-in commands. Nothing is ever downloaded during a scan.

Update Draugr itself#

draugr self-update replaces the running binary in place with the latest published release (or a specific --version), verified against the release's SHA-256 checksums (mandatory) and its keyless cosign signature (when the cosign CLI is present). It replaces the binary you are actually running, so you are never left with a second copy or an older one earlier on your PATH.

draugr self-update            # confirm, then update to the latest release
draugr self-update --check    # just report current vs latest
draugr self-update --version 0.15.0 -y

For CI, pin a released version rather than self-updating.

Provision scanner tools#

draugr tools install downloads pinned tool binaries, verifies each against a SHA-256 recorded in Draugr (sourced from the upstream checksums files), and installs them into ~/.draugr/bin, which Draugr adds to PATH automatically, so scan/doctor use them with no shell config.

Point it at your descriptor. --saga installs the tools that descriptor's scan will run and leaves the rest. The whole catalog is several hundred megabytes, most of it scanners a given project never starts, and every binary on PATH is one more thing to trust and keep patched. With no arguments it installs what the descriptor in the current directory runs, or with none, what draugr scan runs there without one. --all installs everything Draugr can provision.

draugr tools install            # what the descriptor in this directory runs
draugr tools install --saga path/to/other.saga.yaml   # a different one
draugr tools install trivy      # just one
draugr tools install --all      # the whole catalog, into ~/.draugr/bin
draugr tools install --dry-run  # preview the plan, change nothing
draugr tools install -y         # non-interactive

With no arguments it reads the descriptor beside you and says which one it read. In a directory with no descriptor it installs what draugr scan runs there without one, and says so.

It first prints the plan (tool, version, category, verification, destination). Run interactively it asks for confirmation; non-interactively (CI, pipes) it proceeds. Pass -y to be explicit or --dry-run to only preview. git is expected from your system.

Semgrep is installed too, by a different route. It publishes no release binary, its GitHub releases carry no assets, so Draugr builds a virtual environment it owns under ~/.draugr/venv/ and installs the pinned set from PyPI with --require-hashes, then puts a launcher beside the other tools. That needs Python 3.10 or newer on the machine, which doctor checks and names.

The verification claim is the same one a release archive gets and covers more: every artifact in the resolved tree matches a digest recorded in this build of Draugr, dependencies included, rather than one checksum over one file. On a platform the pinned set does not cover, Draugr installs the pinned version without hashes and records the result as unverified rather than claiming a check it did not make.

Why cosign is in the toolbox. cosign is a utility Draugr uses to verify the provenance of other tools (and its own releases, via self-update). Making it installable (draugr tools install cosign) means signature verification "just works" everywhere; it's optional, and doctor reports it but never fails because it's absent. For the full verification story, see verifying releases.

Run draugr tools list to see every tool Draugr knows about, its category, the controls it backs, its pinned version, and whether it's currently found. See the CLI reference for more.

Remove scanner tools#

draugr tools uninstall removes what tools install put under ~/.draugr: each tool's binary, its Python or Node environment, and its data. It leaves a copy installed any other way, and each tool's own cache unless --caches is given. Like install, it prints the plan first.

draugr tools uninstall trivy             # one tool
draugr tools uninstall --all --dry-run   # what removing everything would free
draugr tools uninstall --all --caches    # every tool, and Trivy's and Grype's databases with them

The CLI reference lists which caches each tool keeps.