crt-cli Preview 20261111 (Linux aarch64)

crt-cli Preview — Linux / aarch64

Prerelease, Linux aarch64 (arm64) only. Built from commit 6a00885 (exact tag target) against the public CRT Dev SDK
v0.0.1-preview.20261110.linux.arm64.2. The CLI reports crt-cli 0.1.0-dev.

Asset

File	SHA-256
crt-cli-0.1.0-dev-linux-aarch64-preview.20261111.1.tar.xz (5,039,156 bytes)	fa28ec8d6644da3dc32aaa8e9281c8b953b85d97498cc3cdc12f55b156014cff

The archive holds one statically linked executable crt-cli, the Apache-2.0 license, component licenses/provenance notices and a
format-1 manifest.json (SHA-256 f7739366a3b972aa1db0278ac0edc7e6696c914902bd34b12052fea7cfb13810) pinning every file (30 files). It
contains no SDK, compiler, interpreter, CA certificate or key. Verify the archive digest from a source you trust independently of this page.

Requirements

• Linux aarch64. The executable has no DT_NEEDED entry but requests the ELF loader /lib/ld-linux-aarch64.so.1. Only Ubuntu 26.04 with glibc 2.43 was exercised.
• LLVM 21 clang, clang++, ld.lld, llvm-ar installed on the host (passed with --cc --cxx --linker --ar); the exercised toolchain is Ubuntu's LLVM 21.1.8.
• A PEM CA bundle you choose as the trust input (for example /etc/ssl/certs/ca-certificates.crt), pinned by SHA-256 in the SDK source file.

Try it

tar -xJf crt-cli-0.1.0-dev-linux-aarch64-preview.20261111.1.tar.xz
cd crt-cli
./crt-cli --version
./crt-cli doctor --scope self --resources . --resources-sha256 f7739366a3b972aa1db0278ac0edc7e6696c914902bd34b12052fea7cfb13810

sdk acquire --source <file> takes a crt-cli.sdk-source JSON with the SDK's pinned manifest/policy/archive URLs and digests, the CA file and its SHA-256, and
"redirect_policy": "github-release". The SDK's own release page lists its pins (manifest SHA-256 ba77b26e...67be3, content cd2ab657...0cc6); the format is in the
bootstrap contract.

Verified

On Linux/aarch64 (Ubuntu 26.04, glibc 2.43, LLVM 21.1.8): a contract replay builds this commit from its sources with the public SDK alone (21 sources, cold 21 executed / 0 reused, warm 0 / 21,
native regression 913 checks, 32 distinct executed paths, no DT_NEEDED); the tested, bare and packaged executables are the same bytes. This exact packaged executable, run with an empty PATH
and a fresh HOME against the real network: --version, self doctor with the manifest pin (wrong pin and a changed notice are refused), real GitHub sdk acquire (one redirect per file,
all digests matched), then C and C++ new, first build without configure, test, run, warm rebuild and project doctor, including a parent path with spaces and Korean characters.

Added after publication, on the same executable (the archive is unchanged):

• Restricted-redirect replay, 54/54: the same cases as the other hosts, over the real public SDK bytes behind two loopback TLS origins.
• Sandboxed package run, 27/27: Bubblewrap with the producer and CLI checkouts and every SDK/source tree hidden, an empty PATH, interpreters masked and an execve audit (8 distinct executed paths,
  none unexpected): offline doctor/pin/tamper refusals, real GitHub sdk acquire, and C and C++ new/build/test/run/warm build.

Records: Linux/aarch64 CLI Preview and
redirect replay and sandboxed run.

Not claimed

• No publisher authentication: the archive and manifest are not signed. Trust comes from digests you pin yourself (publisher_authentication: not_verified).
• Not verified here: other glibc versions or distributions, Linux C shared-SDK mode, source-port builds from this package, sdk updates and CLI self-upgrade. The CLI is experimental and its
  JSON/command contract may change.

crt-cli Preview 20261110 (Windows x86_64)

crt-cli Preview — Windows / x86_64

Prerelease, native Windows x64 only. Product sources are commit
a55c0d0ea0801f0e6e8d235f20ca780f876bf970 (the exact tag target), built against the public
CRT Dev SDK v0.0.1-preview.20261110.windows.1.
The CLI reports crt-cli 0.1.0-dev.

Asset and integrity

File	Bytes	SHA-256
crt-cli-0.1.0-dev-windows-x86_64-preview.20261110.1.tar.xz	5430536	4bafc8464b729049840f1f21807f505bbcc09e7d5f7bc260e63d8f971ade75c0

One top-level directory crt-cli-windows-x86_64 contains crt-cli.exe
(45508096 bytes, SHA-256 8a2e854ec33d9e78c4f8c72ed64e928f036a34af62bf31a66016c6ab982cd39b), the CLI and component
licenses/provenance, and an immutable format-1 manifest.json
(SHA-256 7381cd58919be1f1d007cf0091c17e33236797860a8a2087b1139a7e80e6676c): 30 files total. The executable's only direct imports
are KERNEL32.dll and api-ms-win-core-synch-l1-2-0.dll. No SDK, compiler, interpreter,
launcher, CA certificate or key is bundled. SHA256SUMS-windows-x86_64 accompanies the archive.
Verify the archive digest through a source you trust independently of the download.

What works

• Restricted HTTPS redirects for GitHub assets, explicitly enabled by
  "redirect_policy": "github-release" in an SDK source or fetch --redirect-policy github-release.
  Every hop is checked; the default still refuses redirects.
• Pinned sdk acquire from GitHub and immutable SDK installation/reuse.
• C/C++ new, first build without configure, test, run and cached rebuild with project locks.

Requirements and first use

• Windows 10 1903 or later for UTF-8 paths; qualified on Windows 11 Pro build 26100, x64.
• External LLVM/Clang/LLD (qualified with 22.1.8) and Windows SDK um/x64 import libraries
  (qualified with 10.0.28000.0); pass explicit --cc --cxx --linker --ar --os-sdk paths.
• A caller-selected PEM CA bundle with its SHA-256 pinned in the SDK source file.

tar -xJf crt-cli-0.1.0-dev-windows-x86_64-preview.20261110.1.tar.xz
Set-Location .\crt-cli-windows-x86_64
.\crt-cli.exe --version
.\crt-cli.exe doctor --scope self --resources . --resources-sha256 7381cd58919be1f1d007cf0091c17e33236797860a8a2087b1139a7e80e6676c

The Windows guide
provides the pinned SDK source JSON, optional read-only ROOT-to-PEM export and literal C/C++
build commands. The contract
owns the source/redirect format; acceptance
owns exact inputs, receipts and limits.

Verified before publication

Fresh restricted-token SDK-only build/self-build, warm-cache reuse, full native/archive/SDK-store/recipe regressions,
SDK-free commands and the PE import audit also pass; counts and receipt hashes are in acceptance.

The archive packs deterministically twice and safely extracts to 30 inventory-verified files.
This exact executable passes 54/54 redirect cases over the actual public SDK bytes (including
TLS/authority/downgrade/loop/hop-limit/error/pin refusals and signed-query redaction), 12/12
SDK-free package checks and 39/39 packaged public-consumer checks: real GitHub sdk acquire
(three allowed redirects, pinned bytes), reuse without downloads, bad-pin refusal, SDK verify,
and C/C++ first build/test/run/cache with unchanged locks.
Package consumers run under a restricted token with empty PATH, private HOME, source/SDK
visibility probes and job-object process accounting. This is not network or executable denial.

Limits

• Unsigned, no publisher authentication (publisher_authentication: not_verified):
  neither Authenticode nor signed release metadata is supplied. SmartScreen/browser-download
  reputation behavior was not tested. Trust is based on explicit caller pins and CA inputs.
• Windows/arm64, source-port builds from this exact package, Full profiles, SDK updates,
  CLI self-upgrade, official default-download trust and automatic default pin adoption are not qualified here.
• The CLI is experimental; JSON/command contracts may change. This prerelease is not marked latest.

crt-cli Preview 20261110 (macOS arm64)

crt-cli Preview — macOS / arm64

Prerelease, macOS arm64 (Apple silicon) only. Built from commit 541b2afd53980654591a1c6e0a49ceca4057f9b7 (exact tag target) against the public CRT Dev SDK
v0.0.1-preview.20261110.macos.1. The CLI reports crt-cli 0.1.0-dev.

Asset

File	SHA-256
crt-cli-0.1.0-dev-macos-aarch64-preview.20261110.1.tar.xz (1,229,408 bytes)	2767f18da7e7d51e3e3fc1172da99581bf0508c1f6b6794817488c0c58950011

The archive holds one statically linked executable crt-cli (4,389,112 bytes, SHA-256 42727ccaef0e46551bcb9578d5eee771166e8211b8434f8121b589ab57eddfa6, imports only
libSystem), the Apache-2.0 license, component licenses/provenance notices and a format-1 manifest.json (SHA-256
6c7f553f512dbf170936638746d515bfd7ddb006229244b924f4786593c01e63) pinning every file (30 files). It contains no SDK, compiler, interpreter, CA certificate or key.
Verify the archive digest from a source you trust independently of this page.

What this release adds

• Restricted HTTPS redirects, opt-in, for GitHub release assets: sdk acquire with "redirect_policy": "github-release" in the SDK source file
  (or fetch --redirect-policy github-release). Every hop is re-checked; default behavior still refuses redirects.
• First-user workflow in the packaged executable: new / build / test / run for C and C++ against the installed Dev SDK.

Requirements

• macOS on Apple silicon (qualified on macOS 27.2).
• Xcode's command-line toolchain: clang, clang++, ld and ar (pass them with --cc --cxx --linker --ar); the macOS SDK is found with xcrun or given with --os-sdk.
• A PEM CA bundle you choose as the trust input, pinned by SHA-256 in the SDK source file. For example, export the system roots:
  security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain > roots.pem.

Try it

tar -xJf crt-cli-0.1.0-dev-macos-aarch64-preview.20261110.1.tar.xz
cd crt-cli-macos-aarch64
./crt-cli --version
./crt-cli doctor --scope self --resources . --resources-sha256 6c7f553f512dbf170936638746d515bfd7ddb006229244b924f4786593c01e63

sdk acquire --source <file> takes a crt-cli.sdk-source JSON with the SDK's pinned manifest/policy/archive URLs and digests, the CA file and its SHA-256, and
"redirect_policy": "github-release". The pins for SDK v0.0.1-preview.20261110.macos.1 are in the
acceptance record; the format is in the
bootstrap contract.

Verified

On macOS/arm64: native regression (942 checks, built from this commit by the SDK alone), 54/54 redirect replay cases over the real SDK bytes, and this exact packaged
executable under Seatbelt (checkouts unreadable, empty PATH, fresh HOME, real network): self doctor with the manifest pin, real GitHub sdk acquire (three
redirects, all digests matched, installed identity equals the promoted SDK), then C and C++ new, build, test, run and a zero-command warm rebuild.

Not claimed

• No publisher authentication: the archive and manifest are not signed. Trust comes from digests you pin yourself (publisher_authentication: not_verified).
• The executable carries only the linker's ad-hoc signature: it is not Developer ID signed or notarized, and a download that macOS marks as quarantined was not tested.
• Not verified here: Intel macOS, source-port builds from this package, sdk updates and CLI self-upgrade. The CLI is experimental and its JSON/command contract may change.

crt-cli Preview 20261110 (Linux x86_64)

crt-cli Preview — Linux / x86_64

Prerelease, Linux x86_64 only. Built from commit dc796f7 (exact tag target) against the public CRT Dev SDK
v0.0.1-preview.20261110.3. The CLI reports crt-cli 0.1.0-dev.

Asset

File	SHA-256
crt-cli-0.1.0-dev-linux-x86_64-preview.20261110.1.tar.xz (5,232,844 bytes)	ad43afbf7e810bb7b1a587c47568ba6d17bc404e5ee05069a83d9ef56edc1383

The archive holds one statically linked executable crt-cli, the Apache-2.0 license, component licenses/provenance notices and a
format-1 manifest.json (SHA-256 a5c658d38940694c7041ac69ccd854ed7957f2aac4b6a2b55b24625f1f88fc7a) pinning every file (30 files). It
contains no SDK, compiler, interpreter, CA certificate or key. Verify the archive digest from a source you trust independently of this page.

What this release adds

• Restricted HTTPS redirects, opt-in, for GitHub release assets: sdk acquire with "redirect_policy": "github-release" in the SDK source file
  (or fetch --redirect-policy github-release). Every hop is re-checked; default behavior still refuses redirects.
• First-user workflow in the packaged executable: new / build / test / run for C and C++ against the installed Dev SDK.

Requirements

• Linux x86_64 (static executable, no glibc dependency).
• LLVM 21 clang, clang++, ld.lld, llvm-ar installed on the host (passed with --cc --cxx --linker --ar).
• A PEM CA bundle you choose as the trust input (for example /etc/ssl/certs/ca-certificates.crt), pinned by SHA-256 in the SDK source file.

Try it

tar -xJf crt-cli-0.1.0-dev-linux-x86_64-preview.20261110.1.tar.xz
cd crt-cli-linux-x86_64
./crt-cli --version
./crt-cli doctor --scope self --resources . --resources-sha256 a5c658d38940694c7041ac69ccd854ed7957f2aac4b6a2b55b24625f1f88fc7a

sdk acquire --source <file> takes a crt-cli.sdk-source JSON with the SDK's pinned manifest/policy/archive URLs and digests, the CA file and its
SHA-256, and "redirect_policy": "github-release". The pins for SDK v0.0.1-preview.20261110.3 are in the
acceptance record;
the format is in the bootstrap contract.

Verified

On Linux/x86_64: native regression (901 checks), 54/54 redirect replay cases over the real SDK bytes, and this exact packaged executable with an empty PATH and a
fresh HOME: real GitHub sdk acquire (three redirects, all digests matched), then C and C++ new, build, test, run.

Not claimed

• No publisher authentication: the archive and manifest are not signed. Trust comes from digests you pin yourself (publisher_authentication: not_verified).
• Not verified here: macOS and Windows packages, Linux aarch64, restricted-redirect replay on other hosts, Linux C shared-SDK mode, source-port builds from this
  package, sdk updates and CLI self-upgrade. The CLI is experimental and its JSON/command contract may change.