v26.09.3

arcli 26.09.3 makes the token optional for Arc servers that run without authentication.

Changed

• A connection no longer needs a token. arcli config create --name lab --endpoint http://lab:8000 (no --token), --endpoint URL alone, and ARC_ENDPOINT alone are all accepted; arcli then sends no Authorization header, which is what an Arc with auth.enabled = false expects. config create and config update --token "" print a note that such a profile only works against a server without authentication, and config list / config current show the token as (none).
• A token without an endpoint (--token alone, ARC_TOKEN alone) is still an error: it names no server.
• arcli ping against a server that does require a token, from a connection that has none, now says so (server requires a token but this connection has none) instead of quoting a bare 401.

Changelog

• 1c64abf: feat(config): token optional for Arc servers with auth.enabled = false (@xe-nvdk)

---

Install

Homebrew	brew install basekick-labs/tap/arcli
Debian / Ubuntu	sudo dpkg -i arcli_26.09.3_amd64.deb (or _arm64.deb)
RHEL / Fedora	sudo rpm -i arcli-26.09.3-1.x86_64.rpm (or .aarch64.rpm)
Arch	sudo pacman -U arcli-26.09.3-1-x86_64.pkg.tar.zst (or -aarch64)
Docker	docker run --rm ghcr.io/basekick-labs/arcli:26.09.3 --version
Go	go install github.com/basekick-labs/arcli/cmd/arcli@latest (builds main; Go does not accept CalVer tags for this module path)

Every archive carries a SPDX SBOM (*.sbom.json); checksums.txt covers all archives, packages and SBOMs and is signed keylessly with cosign:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/Basekick-Labs/arcli/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt