crt-cli Preview 20261111 (Linux aarch64)

crt-cli Preview — Linux / aarch64

Prerelease, Linux aarch64 (arm64) only. Built from commit 6a00885 (exact tag target) against the public CRT Dev SDK
v0.0.1-preview.20261110.linux.arm64.2. The CLI reports crt-cli 0.1.0-dev.

Asset

File	SHA-256
crt-cli-0.1.0-dev-linux-aarch64-preview.20261111.1.tar.xz (5,039,156 bytes)	fa28ec8d6644da3dc32aaa8e9281c8b953b85d97498cc3cdc12f55b156014cff

The archive holds one statically linked executable crt-cli, the Apache-2.0 license, component licenses/provenance notices and a
format-1 manifest.json (SHA-256 f7739366a3b972aa1db0278ac0edc7e6696c914902bd34b12052fea7cfb13810) pinning every file (30 files). It
contains no SDK, compiler, interpreter, CA certificate or key. Verify the archive digest from a source you trust independently of this page.

Requirements

• Linux aarch64. The executable has no DT_NEEDED entry but requests the ELF loader /lib/ld-linux-aarch64.so.1. Only Ubuntu 26.04 with glibc 2.43 was exercised.
• LLVM 21 clang, clang++, ld.lld, llvm-ar installed on the host (passed with --cc --cxx --linker --ar); the exercised toolchain is Ubuntu's LLVM 21.1.8.
• A PEM CA bundle you choose as the trust input (for example /etc/ssl/certs/ca-certificates.crt), pinned by SHA-256 in the SDK source file.

Try it

tar -xJf crt-cli-0.1.0-dev-linux-aarch64-preview.20261111.1.tar.xz
cd crt-cli
./crt-cli --version
./crt-cli doctor --scope self --resources . --resources-sha256 f7739366a3b972aa1db0278ac0edc7e6696c914902bd34b12052fea7cfb13810

sdk acquire --source <file> takes a crt-cli.sdk-source JSON with the SDK's pinned manifest/policy/archive URLs and digests, the CA file and its SHA-256, and
"redirect_policy": "github-release". The SDK's own release page lists its pins (manifest SHA-256 ba77b26e...67be3, content cd2ab657...0cc6); the format is in the
bootstrap contract.

Verified

On Linux/aarch64 (Ubuntu 26.04, glibc 2.43, LLVM 21.1.8): a contract replay builds this commit from its sources with the public SDK alone (21 sources, cold 21 executed / 0 reused, warm 0 / 21,
native regression 913 checks, 32 distinct executed paths, no DT_NEEDED); the tested, bare and packaged executables are the same bytes. This exact packaged executable, run with an empty PATH
and a fresh HOME against the real network: --version, self doctor with the manifest pin (wrong pin and a changed notice are refused), real GitHub sdk acquire (one redirect per file,
all digests matched), then C and C++ new, first build without configure, test, run, warm rebuild and project doctor, including a parent path with spaces and Korean characters.

Added after publication, on the same executable (the archive is unchanged):

• Restricted-redirect replay, 54/54: the same cases as the other hosts, over the real public SDK bytes behind two loopback TLS origins.
• Sandboxed package run, 27/27: Bubblewrap with the producer and CLI checkouts and every SDK/source tree hidden, an empty PATH, interpreters masked and an execve audit (8 distinct executed paths,
  none unexpected): offline doctor/pin/tamper refusals, real GitHub sdk acquire, and C and C++ new/build/test/run/warm build.

Records: Linux/aarch64 CLI Preview and
redirect replay and sandboxed run.

Not claimed

• No publisher authentication: the archive and manifest are not signed. Trust comes from digests you pin yourself (publisher_authentication: not_verified).
• Not verified here: other glibc versions or distributions, Linux C shared-SDK mode, source-port builds from this package, sdk updates and CLI self-upgrade. The CLI is experimental and its
  JSON/command contract may change.