Updating

To update Hulk after your first installation, run

hulk update

Hulk verifies updates before replacing the installed executable. The release manifest is signed with an Azure Key Vault key embedded as a public trust anchor in Hulk. The updater then checks the selected binary’s platform, byte size, SHA-256 digest, and reported version.

Downloaded shell or PowerShell scripts are not executed during an update. On Linux and macOS, Hulk requests sudo only when its installation directory requires elevated write access. On Windows, the verified replacement is completed after the running process exits.

Use --force to reinstall the current signed version:

hulk update --force

Hulk refuses signed releases older than the installed version. If signature, origin, size, checksum, or smoke-test validation fails, the existing executable is left in place.