v26.09.4

arcli 26.09.4 adds arcli sample: load a real public dataset into your own Arc instead of writing one synthetic point and wondering what Arc is for.

Added

• arcli sample load citibike downloads a month of NYC Citi Bike trips (31 files, 39.4 MiB, 1,003,770 rows), verifies every file against the published SHA-256, imports it, and prints two queries worth running against what just landed. It creates the target database if it does not exist, and takes about three seconds against a local Arc once the files are down.
• arcli sample list shows the published datasets, one row per dataset and month. arcli sample show citibike gives the details, licence and time window; -o json adds every file URL and checksum, so the data can be fetched without arcli and imported with arcli import parquet.
• --month, --database and --measurement override the manifest's defaults. --download-only fetches and verifies without importing and needs no Arc connection at all; --download-dir keeps the Parquet somewhere durable instead of a temp directory.
• Interrupted downloads resume: a file already present with a matching checksum is not fetched again, and a file whose checksum does not match is re-downloaded once before the command fails rather than importing data that does not match the manifest.
• If the target measurement already holds rows, load says so and asks before adding more, so a second run cannot silently double the counts the printed queries report. --yes skips that prompt; a non-interactive shell refuses rather than hanging.

Privacy

• The sample datasets come from samples.basekick.net, and these are the only arcli commands that contact a Basekick-controlled host. Every other command still talks solely to the Arc servers you configured.
• Those requests carry the same User-Agent and Arcli-Installation-Id as any other arcli request, and the existing opt-outs apply unchanged (DO_NOT_TRACK=1, or send_installation_id = false in the config file). They never carry your token, your Arc endpoint, or anything about your data.
• The README's Privacy section previously said arcli never contacts Basekick or any third party. That is no longer true, and it now describes what is actually sent, including that fetching a file over the internet reveals your IP address and the file requested to whoever serves it.
• arcli sample show <dataset> -o json prints every file URL and SHA-256, so anyone who would rather not fetch from us can download the data another way and use arcli import parquet.

Notes

• Importing requires an admin token when the Arc server has authentication enabled; the check runs before anything is downloaded rather than failing on the first file.
• Downloads run four at a time and stop as soon as one fails, so a build the sample host does not recognise costs a handful of requests instead of a full dataset of them.

Changelog

• 62fd212: feat(sample): arcli sample {list,show,load} for real datasets (#26) (@xe-nvdk)

---

Install

Homebrew	brew install basekick-labs/tap/arcli
Debian / Ubuntu	sudo dpkg -i arcli_26.09.4_amd64.deb (or _arm64.deb)
RHEL / Fedora	sudo rpm -i arcli-26.09.4-1.x86_64.rpm (or .aarch64.rpm)
Arch	sudo pacman -U arcli-26.09.4-1-x86_64.pkg.tar.zst (or -aarch64)
Docker	docker run --rm ghcr.io/basekick-labs/arcli:26.09.4 --version
Go	go install github.com/basekick-labs/arcli/cmd/arcli@latest (builds main; Go does not accept CalVer tags for this module path)

Every archive carries a SPDX SBOM (*.sbom.json); checksums.txt covers all archives, packages and SBOMs and is signed keylessly with cosign:

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/Basekick-Labs/arcli/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt