build(duckdb): pin DuckDB v2.0.0 LTS

CONTRIBUTING.md

@@ -29,7 +29,7 @@ Keep this file out of Git and Docker inputs. See
 [runtime secret delivery](docs/operations.md#runtime-secret-delivery).
 
 The DuckDB wrapper downloads the pinned, checksum-verified engine from
-[Fanout's dependency artifact mirror](https://github.com/labstack/fanout/releases/tag/duckdb-v2.0.0-alpha46057)
+[DuckDB's `v2.0.0` release](https://github.com/duckdb/duckdb/releases/tag/v2.0.0)
 on the first build. Linux needs the C++ runtime (`libstdc++`); macOS needs
 Xcode Command Line Tools and `libc++`. Cross-compilation is unsupported.
 Use `just` recipes or prefix Go commands with the wrapper:
@@ -46,11 +46,10 @@ Alternatively configure your editor to launch `gopls` through
 `bash scripts/with-duckdb.sh gopls serve`. An already-running editor process
 must be restarted to inherit these variables.
 
-The dependency mirror preserves the original DuckDB `v2.0.0-alpha46057`
-archives at upstream commit `b15358c371` byte for byte. Its `duckdb-` tag
-namespace is separate from Fanout's product CalVer releases; new engine bytes
-require a new artifact tag and checksum pins. It never supplies a second engine
-or downloads extensions at runtime.
+The wrapper uses DuckDB's published static-library archives for upstream
+commit `d54cbbe3df` and rejects any archive whose SHA-256 differs from its pin.
+A new engine version requires new checksum pins. The wrapper never supplies a
+second engine or downloads extensions at runtime.
 
 ## Before you open a pull request
 

THIRD_PARTY_NOTICES

@@ -73,7 +73,7 @@ COMPONENT INVENTORY
 - Go: modernc.org/mathutil v1.7.1
 - Go: modernc.org/memory v1.12.1
 - Go: modernc.org/sqlite v1.60.1
-- Native: DuckDB v2.0.0-alpha46057 (b15358c371)
+- Native: DuckDB v2.0.0 (d54cbbe3df)
 - npm: @ag-ui/client 1.0.2 (declared license: MIT)
 - npm: @ag-ui/core 1.0.2 (declared license: MIT)
 - npm: @ag-ui/encoder 1.0.2 (declared license: MIT)
@@ -5136,11 +5136,11 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 --- Applies to -------------------------------------------------------------
-- Native: DuckDB v2.0.0-alpha46057 (b15358c371) / duckdb-NOTICE
+- Native: DuckDB v2.0.0 (d54cbbe3df) / duckdb-NOTICE
 ----------------------------------------------------------------------------
 
-DuckDB b15358c371 — upstream license and bundled third-party notices.
-Source: https://github.com/duckdb/duckdb/tree/b15358c371
+DuckDB d54cbbe3df — upstream license and bundled third-party notices.
+Source: https://github.com/duckdb/duckdb/tree/d54cbbe3df
 
 --- LICENSE ---
 

internal/duckdb/native.go

@@ -18,8 +18,8 @@ static int register_extensions(void) {
 */
 import "C"
 
-const Version = "v2.0.0-alpha46057"
-const SourceCommit = "b15358c371"
+const Version = "v2.0.0"
+const SourceCommit = "d54cbbe3df"
 
 func init() {
 	if C.GoString(C.duckdb_library_version()) != Version {

internal/query/testdata/duckdb-functions.txt

@@ -1,4 +1,4 @@
-# engine v2.0.0-alpha46057
+# engine v2.0.0
 != scalar
 !__postfix scalar
 !~~ scalar

scripts/with-duckdb.sh

@@ -3,26 +3,26 @@
 set -euo pipefail
 
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-version=v2.0.0-alpha46057
+version=v2.0.0
 case "$(uname -s)/$(uname -m)" in
 Darwin/arm64)
 	platform=osx-arm64
-	checksum=e78e6a3ab5c35c1451650cdd234e9f42c8c9485412aaf063dfaae995f0dcda6a
+	checksum=c3a571e6d4a0da97534c631df463ab13c07f8cf78049625f5df936b7beaab9ce
 	system_libs='-lc++ -Wl,-no_warn_duplicate_libraries'
 	;;
 Darwin/x86_64)
 	platform=osx-amd64
-	checksum=a1dd2b83754484dcd0980ed1c46d5726ec2a2fd26090d43341dc74f1060abff3
+	checksum=7e6101ddc8de73e8dcc66f790e658e07891165d026992b40ceba20e50b01f8ec
 	system_libs='-lc++ -Wl,-no_warn_duplicate_libraries'
 	;;
 Linux/x86_64)
 	platform=linux-amd64
-	checksum=4cb2df2e767f2a08fb38a0c39b8dadd1ad0eb07fd5cd6431092e709be41a323e
+	checksum=112d62c980f5447cd303a70b3dacbc09acd41ccb4ef6d154e8629f543a0f8568
 	system_libs='-lstdc++ -lm -ldl -pthread'
 	;;
 Linux/aarch64)
 	platform=linux-arm64
-	checksum=81cf834f18a7004d412862d25bbbd334c1e335432c94a2cbcb6c0f560ebbc3eb
+	checksum=8171b4842e68a85b2e82b342d3bf7b542a88fd6666e0c18438d7b459012494ee
 	system_libs='-lstdc++ -lm -ldl -pthread'
 	;;
 *)
@@ -53,7 +53,7 @@ if [[ ! -f "$libs/.verified" ]]; then
 		if [[ ! -f "$libs/.verified" ]]; then
 			stage="$(mktemp -d "$(dirname "$libs")/.download.XXXXXX")"
 			trap 'rm -rf "$stage"; rmdir "$lock"' EXIT
-			url="https://github.com/labstack/fanout/releases/download/duckdb-$version/duckdb-static-libs-$platform.tar.gz"
+			url="https://github.com/duckdb/duckdb/releases/download/$version/duckdb-static-libs-$platform.tar.gz"
 			curl --fail --location --silent --show-error "$url" -o "$stage/archive.tar.gz"
 			if [[ "$platform" == osx-* ]]; then
 				actual="$(shasum -a 256 "$stage/archive.tar.gz" | awk '{print $1}')"

site/src/content/docs/explanation/storage-model.mdx

@@ -98,7 +98,7 @@ string encoding when querying them for a JSON client.
 
 ## Engine and format are pinned
 
-Fanout embeds DuckDB `v2.0.0-alpha46057`, a preview engine, with its extensions
+Fanout embeds DuckDB `v2.0.0`, the 2.0 LTS release, with its extensions
 compiled into the binary. It downloads no extensions at runtime. Native source
 builds use `scripts/with-duckdb.sh`, which checks the platform archive and uses
 the matching engine headers; the ordinary `just` build and test recipes invoke

third_party/notices/duckdb-NOTICE.txt

@@ -1,5 +1,5 @@
-DuckDB b15358c371 — upstream license and bundled third-party notices.
-Source: https://github.com/duckdb/duckdb/tree/b15358c371
+DuckDB d54cbbe3df — upstream license and bundled third-party notices.
+Source: https://github.com/duckdb/duckdb/tree/d54cbbe3df
 
 --- LICENSE ---