roastedDuck 1.5.6.post2

roastedDuck 1.5.6.post2 completes the project rename throughout the Rust engine and developer tools. It is an MIT-licensed compatibility preview targeting DuckDB 1.5.6, with the maintenance branch v1.5-variegata.

Install

python -m pip install roastedduck

Use a fresh virtual environment; the compatibility import remains duckdb. For an existing installation, add --upgrade.

All 32 formerly legacy-named Rust crates now use roastedduck-* package names and roastedduck_* identifiers. The CLI package is roastedduck-cli; the executable, interactive banner, version output and help use roastedDuck. Build from source with:

cargo build --locked --release --bin roastedDuck -j 1

Native SDK archives contain the real bin/roastedDuck executable. The DuckDB-compatible C ABI, Python duckdb import and Swift DuckDB module retain their established interfaces.

This revision also includes patched developer-validation requirements and audits the complete installed test environments alongside the Rust lockfile. Validation dependencies are not mandatory runtime dependencies of the Python package. Earlier releases and their evidence remain unchanged.

Python distributions cover normal CPython 3.10–3.14 on Linux x86_64, Linux ARM64 and macOS Apple Silicon; Linux wheels require glibc 2.28 or newer. Native SDKs include CLI, shared/static libraries, C/ADBC headers, Go client source and third-party notices. Linux Swift packages and a signed Apple framework package are included separately.

The release source is 461cd02b350d99d812552d085b100e40d8ecacb5. The Apple archive retains its actual build commit 76b50b037decafe6773cebeddbfdba94b23a92f7; all 1,975 engine inputs match the release source. Qualification evidence is shipped with the assets: paired Python outcomes, source-archive rebuild, C API/ADBC, Go/Swift, encrypted checkpoint/WAL interoperability, native identities and SHA-256 checksums. Nonpasses are preserved. launch-acceptance.json records pre-publication artifact acceptance; subsequent official-index installation checks establish PyPI publication.

This remains a public preview. Physical iOS execution and Apple notarization are unverified. Simulator execution and device build evidence are distinguished in the reports. Historical benchmark and corpus results retain their original candidate/date scope. Windows, Intel Mac binaries, free-threaded Python and PyPy are outside the advertised package matrix.

PyPI accepted all 16 distributions with matching SHA-256 digests. All 15 ordinary-index installation checks and three-platform GitHub download/install checks passed.

The initial index-check run had four cells resolve the previous post1 version. Those failures remain recorded; the unchanged full rerun above verified post2 on all 15 cells.

Documentation · Source and issues

roastedDuck 1.5.6.post1 — security and packaging preview

roastedDuck 1.5.6.post1 is the security and packaging revision of the MIT-licensed DuckDB 1.5.6 compatibility preview. The maintenance branch remains v1.5-variegata. Existing 1.5.6 downloads remain unchanged.

This revision updates PyO3, rsa, and ctutils; packages complete third-party notices; makes the public ADBC header self-contained; and retains the Go client source in native SDKs. Python packages cover CPython 3.10–3.14 on Linux x86_64, Linux ARM64, and macOS Apple Silicon. Linux wheels require glibc 2.28 or newer. A source distribution is also included.

The release assets include Python distributions, native CLI/C/C++ SDKs, Linux Swift packages, the signed Apple framework package, SHA-256 checksums, and qualification evidence. The source archive is independently rebuilt outside the checkout. Runtime qualification covers paired Python tests, C API, ADBC, Go, Swift, and encrypted checkpoint/WAL interoperability.

The release tag identifies native producer d445a14533e9b76b6b37547b31c00db47f66131d. The separately identified observer verifies the original immutable artifacts and supports pip 23's legacy installation-report format. GitHub's internal server error prevented two qualification jobs from starting; a pinned recovery run executes those original steps against the same native artifacts. Its first-created Linux x86_64 Swift archive is identified separately. The producer's failed conclusion, recovery results, and observer result are retained in observer-verification.json; the observer does not rebuild or repack engine libraries or Python distributions.

This remains a compatibility preview. Physical iOS execution and Apple notarization are unverified; simulator and device build evidence are distinguished in the included reports. Previously published benchmark and corpus measurements keep their original candidate/date scope.

Install in a fresh environment with python -m pip install roastedduck. PyPI accepted all 15 wheels and the source archive with matching SHA-256 digests. All 15 ordinary PyPI installation checks and three-platform GitHub download checks passed. The immutable launch-acceptance.json records pre-publication artifact acceptance; these later workflow runs establish publication and real index installation.

Documentation · Source and issues

roastedDuck 1.5.6 — public preview

roastedDuck 1.5.6

roastedDuck now uses the same version number and version-family branch naming as its DuckDB compatibility target: package version 1.5.6, tag v1.5.6, and maintenance branch v1.5-variegata, with main for integration. This supersedes the initial 0.1.0-alpha.1 numbering.

This is still a public preview. Version alignment describes the compatibility target; existing exceptions and maturity boundaries remain explicit. The Rust native engine bytes are unchanged from the qualified source2551 candidate.

Documentation · Installation · Compatibility · Benchmark data

Packages

• CLI/native SDKs and optional static libraries: macOS arm64, Linux arm64, Linux x86_64.
• roastedduck==1.5.6 Python wheels for normal CPython 3.10–3.14 on those platforms. The compatibility import remains duckdb; use a fresh virtual environment and do not co-install the official duckdb distribution.
• Apple ARM64 and Linux Swift packages; Go uses the pinned source and duckdb_use_lib,duckdb_arrow tags.
• SHA256SUMS, provenance.json, benchmark evidence, and the recorded qualification summary.

Native libraries, engine identifiers, and Python distribution versions now all report 1.5.6. Public packaging metadata has new hashes and separate installation checks. The original 0.1.0 preview and all of its assets remain unchanged as historical evidence.

Scope

The recorded candidate exercised all 4,870 SQL files on each desktop target, retaining 14 classified raw failures per platform, matching skips/nonpasses, shell differences, and reference incidents. The historical full Linux x86_64 qualification used translation; native hosted installation checks are separate. Physical iOS execution/provisioning remains unverified. Historical development signatures are not Apple Developer ID notarization. Windows, Intel Macs, and additional language clients are outside this preview.

Recorded macOS TPC-H SF10/ClickBench configurations show 60–76% lower geometric-mean whole-process peak RSS with 7–16% longer geometric-mean best query times. ClickBench summed best times are 23–25% longer, and individual memory and stress-case regressions remain published. No new engine/performance qualification is implied by renumbering.

MIT licensed with retained upstream and third-party notices. roastedDuck is independently maintained and is not affiliated with or endorsed by the DuckDB Foundation. DuckDB is a trademark of the DuckDB Foundation.

Python dependency advisories

The frozen Python extension uses PyO3 0.27.2. GitHub reports GHSA-36hh-v3qg-5jq4 (iterator bounds handling) and GHSA-chgr-c6px-7xpp (closure thread-safety bounds), patched upstream in PyO3 0.29.0. Applicability to these bindings has not been fully audited. This version-alignment release retains the existing native extension and does not claim to fix those dependency advisories.

Verification for 1.5.6

Published installation checks passed on native Linux x86_64, Linux arm64, and macOS arm64: downloaded checksums, CLI, CPython 3.12 persistence/Parquet, C API, Go, and Apple Swift. Local CPython 3.14 also passed. All 15 wheels passed RECORD and native-entry checks; all ten renamed archives were byte-identical to their previous versions. GitHub's server digests matched all 28 uploaded assets.

Source checks passed on the PR tree, which is identical to the release commit tree. Documentation deployment passed, and live installation/release/contribution pages show the new version and branch.

Additional dependency findings (November 9, 2026)

These unchanged historical assets also contain ctutils 0.4.3 (RUSTSEC-2026-0385, non-constant-time operations) and rsa 0.9.10 (RUSTSEC-2023-0071, private-key timing issue). The project uses rsa for public-key signature verification; no production private-key decryption path was identified. A new source-built 1.5.6.post1 candidate is being qualified with fixed dependencies. The historical assets have not been rebuilt and are not security-fixed by this notice.

roastedDuck 0.1.0-alpha.1 — public preview

Superseded by roastedDuck 1.5.6, which aligns version and release-branch naming with the compatibility target. Original assets and checksums are retained unchanged.

roastedDuck 0.1.0-alpha.1

First public preview of roastedDuck, an independent MIT-licensed Rust analytical SQL engine targeting DuckDB 1.5.6 compatibility.

Documentation · Installation · Compatibility · Benchmarks and raw data

Downloads

• Native dynamic SDKs: macOS arm64, Linux arm64, Linux amd64. Each includes the CLI, headers, shared library, pinned Go client source, and notices. Optional static libraries have separate archives.
• Python: normal CPython 3.10–3.14 wheels for those three platforms. Distribution name roastedduck, compatibility import duckdb; use a fresh virtual environment. The official duckdb distribution must not be co-installed.
• Swift: Apple ARM64 XCFramework package and Linux packages. Physical iOS execution/provisioning remains unverified.
• SHA256SUMS, provenance.json, and a compact evidence archive. Verify downloads before executing them.

Native engine bytes come from the November 6 source2551 candidate and are unchanged. Python distribution metadata, version helper, license additions, and wheel RECORD are repackaged with separate installation checks. Native compatibility version identifiers remain 1.5.6; the Python distribution version is 0.1.0a1. Historical development signatures are not Apple Developer ID notarization.

Evidence and limitations

Recorded qualification exercised all 4,870 SQL files per desktop target, selected Python/Go/Swift suites, C API/ADBC, persistence/WAL, and relocated artifacts. Fourteen classified raw SQL failures per platform, matching nonpasses, shell differences, and reference incidents remain explicit. Full historical qualification is distinct from current CI and release installation smoke tests. Original Linux x86_64 qualification used translation; hosted native smoke checks have narrower scope.

Recorded macOS TPC-H SF10/ClickBench configurations show 60–76% lower geometric-mean whole-process peak RSS with 7–16% longer geometric-mean best query times. ClickBench summed best times are 23–25% longer, its largest single-thread peak is almost unchanged, and individual stress cases regress substantially. Every query is published. No blanket performance, compatibility, or production-readiness claim is made.

Windows, Intel Macs, and additional language clients are outside this preview.

roastedDuck is independently maintained and is not affiliated with or endorsed by the DuckDB Foundation. DuckDB is a trademark of the DuckDB Foundation. Upstream and third-party notices are retained.

Public installation verification — November 8, 2026

Release installation workflow passed on native Ubuntu x86_64, Ubuntu arm64, and macOS arm64 runners. Each downloaded and checksum-verified the published SDK and CPython 3.12 wheel, then exercised the CLI, Python identity/persistence/Parquet, C API, and Go consumer. The macOS job also downloaded and exercised the Apple Swift package. This is native installation evidence, separate from the historical full-suite qualification.

Clean source checks and documentation deployment passed on the release commit. The initial draft-only installation attempt could not access the draft using its read-only token and executed no binaries; the published-release run above passed.

qualification-summary.json preserves the original 23 requirement dispositions and source-receipt hash. All 28 uploaded assets were checked against GitHub's server-reported SHA-256 digests.

Python dependency advisories

The frozen Python extension uses PyO3 0.27.2. GitHub reports GHSA-36hh-v3qg-5jq4 and GHSA-chgr-c6px-7xpp, patched upstream in PyO3 0.29.0. Applicability to these bindings has not been fully audited. These historical assets have not been rebuilt to fix those dependency advisories.

Additional dependency findings (November 9, 2026)

These unchanged historical assets also contain ctutils 0.4.3 (RUSTSEC-2026-0385, non-constant-time operations) and rsa 0.9.10 (RUSTSEC-2023-0071, private-key timing issue). The project uses rsa for public-key signature verification; no production private-key decryption path was identified. A new source-built 1.5.6.post1 candidate is being qualified with fixed dependencies. The historical assets have not been rebuilt and are not security-fixed by this notice.