Skip to content

packdb-cli 0.2.4

Latest
Latest

Choose a tag to compare

View all tags
@aaraujo aaraujo released this 21 Oct 13:20
v0.2.4
5aaa6cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

PackDB query CLI 0.2.4

  • Build against SDK 0.2.4. Query flags, output and exit codes are unchanged.
  • Replace the LICENSE files (repository root, packdb-query-cli, and the copy in each binary archive) with the verbatim Apache License 2.0 text. CLI 0.2.0–0.2.3 shipped an altered text: the Trademarks clause (section 6) was missing, sections 7 to 9 were renumbered 6 to 8, the copyright grant wording differed, and section 9 was retitled. The CLI's licensing (Apache-2.0, as declared in Cargo.toml and the source headers) is unchanged.
  • Use rustls-webpki 0.103.16 and webpki-root-certs 1.0.10, addressing RUSTSEC-2026-0382 and RUSTSEC-2026-0383.

This release supersedes CLI 0.2.0–0.2.3. Prefer 0.2.4 for new installations. Old tags and asset bytes are preserved for provenance.

The release binaries are built from the committed lockfile. --locked reproduces the reviewed dependency versions (cargo build --locked, cargo install --locked). Unlocked builds may also resolve patched versions; verify the resolved versions and audit the resulting lockfile.

Linux x86_64 GNU and macOS arm64 binaries are built and tested natively with flight-sql. Linux retains the declared glibc 2.35 floor. macOS binaries are not notarized. Packages remain unpublished to crates.io.

Qualified source: 5aaa6cb8d009ddf2432c0447b18e2510b22dd67e, built against SDK 543ba67439b172783804b965bc3dafa2f3c46261 (SDK v0.2.4).

Full qualification: https://github.com/packdb-oss/packdb-cli/actions/runs/39532913671 (attempt 1). The downloaded source archive matches this Git tree byte for byte; package/dependency inventories, checksums and provenance were verified. The LICENSE in the source archive and in both binary archives was checked against the Apache License 2.0 text.
Both native targets passed extracted-artifact contract checks and the Linux glibc-floor assertion. THIRD_PARTY_NOTICES.txt is embedded in each binary archive. The downloaded macOS archive was also exercised after verification.

GitHub attaches package inventories by filename. Put the package inventory files in package-inventories/ before checking the original SHA256SUMS.
Each binary archive also has its own .sha256 file.

Assets 12
Loading