packdb-cli 0.2.2

Superseded by v0.2.4. This release's LICENSE files, including the copy in each binary archive, are an altered Apache License 2.0 text (the Trademarks clause, section 6, is missing; later sections are renumbered and reworded), and its lockfile has rustls-webpki 0.103.15 and webpki-root-certs 1.0.9 (RUSTSEC-2026-0382, RUSTSEC-2026-0383). v0.2.4 ships the verbatim license text and the patched versions; the CLI's Apache-2.0 licensing is unchanged. This release's tag, assets and checksums are kept unchanged.

Built against packdb-client 0.2.2. The CLI's flags, output and exit codes are unchanged. See CHANGELOG.md.

• Replaces the yanked yoke-derive 0.8.3 lockfile entry with 0.8.4.
• Adds Dependabot and a scheduled action-pin check, requires the Apache 2.0 notice in every source file, and records this repository as the canonical source of the CLI.

Not published to crates.io.

Source: 150d9c413ad00ac578f7e95f64c841e6a6684862 (#10). Built against SDK cfdebdcaa584e8c3eb75d9b7c873a843a9d5f912 (packdb-sdk v0.2.2, tree 4c5cfa8f577ac2d771e91f60365cff579981112a).

Binaries

Both are built natively, with no cross-compilation, with flight-sql enabled:

target	runner	archive SHA-256
x86_64-unknown-linux-gnu	ubuntu-22.04	dee8f36a507e976785a9bcf1248db99249a3a3c631b9c87c0121f1be0632468c
aarch64-apple-darwin	macos-15	ef9eb76d6eec1e9fa8c3705d0a1d5108e7630d3d5b9fdcfe0436c88814d9c376

• Linux: requires glibc 2.35 or newer. This declared floor is checked against the shipped binary's GLIBC_* symbols; the highest symbol it needs is GLIBC_2.34.
• macOS: the binary is not notarized. macOS blocks browser-downloaded copies by default.

Each archive contains the binary, LICENSE, COMPATIBILITY.md, DEPENDENCIES.txt and PROVENANCE.txt.

Provenance

All assets come from candidate run 36924931433 (attempt 1). That run passed the full checks, coverage, compatibility and security gates on this commit. It also checked the shipped contract against both extracted binaries: help, version, both transport flags and every documented exit code. The source archive is byte-identical to the tagged tree.

asset	SHA-256
packdb-cli-0.2.2-source.tar.gz	c0baa2e72b907a711374bea5c3bfc875a45187575399b530de055f727a975754
release-record.json	0ed10059052dbdef8be97348a001ffa3f5e42b832c1089c92160fba09215002f
SHA256SUMS	d7a0c5e8f3cef19688db6c40bec3c8d6e4ced3bf2605e376a8778dccd1616372

SHA256SUMS lists the package inventory under package-inventories/. It is attached here by file name; put it in that directory before running shasum -a 256 -c SHA256SUMS.

Third-party attribution supplement (2026-10-19)

The original binary archives and their checksums are unchanged. Download the matching packdb-query-VERSION-TARGET-THIRD_PARTY_NOTICES.txt alongside each binary archive. These companion files contain license texts and original copyright/NOTICE files generated from this release's exact locked CLI/SDK sources for each target. Verify them with THIRD_PARTY_NOTICES-SHA256SUMS; the original SHA256SUMS continues to describe the original assets. Future patched binary archives include these notices inside the archive.

Superseded by 0.2.3

Use 0.2.3 for new installations. This older release records Rustls 0.23.45, affected by RUSTSEC-2026-0346 through RUSTSEC-2026-0349. The original tags, source and binary bytes are retained for provenance; their passing historical qualification does not establish that they are free of later-discovered vulnerabilities.