From d7fae0c951f0c15c419322dd90d7efc1724a68fa Mon Sep 17 00:00:00 2001 From: Vishal Rana Date: Wed, 21 Oct 2026 16:54:22 -0700 Subject: [PATCH] build(duckdb): pin DuckDB v2.0.0 LTS Move the embedded engine from v2.0.0-alpha46057 (b15358c371) to the v2.0.0 release (d54cbbe3df). The wrapper now downloads DuckDB's published static-library archives from the upstream v2.0.0 release and pins their SHA-256 values. A GA release publishes permanent assets, so Fanout no longer needs its own mirror of preview build archives. No built-in was added, removed, or retyped, so the function snapshot changes only its engine header. No upstream license or notice file changed between the two commits. No code change was needed. The startup check confirms duckdb_library_version() reports v2.0.0. --- CONTRIBUTING.md | 11 +++++------ THIRD_PARTY_NOTICES | 8 ++++---- internal/duckdb/native.go | 4 ++-- internal/query/testdata/duckdb-functions.txt | 2 +- scripts/with-duckdb.sh | 12 ++++++------ site/src/content/docs/explanation/storage-model.mdx | 2 +- third_party/notices/duckdb-NOTICE.txt | 4 ++-- 7 files changed, 21 insertions(+), 22 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 7c47f5fd..a7aaa9f4 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -29,7 +29,7 @@ Keep this file out of Git and Docker inputs. See [runtime secret delivery](docs/operations.md#runtime-secret-delivery). The DuckDB wrapper downloads the pinned, checksum-verified engine from -[Fanout's dependency artifact mirror](https://github.com/labstack/fanout/releases/tag/duckdb-v2.0.0-alpha46057) +[DuckDB's `v2.0.0` release](https://github.com/duckdb/duckdb/releases/tag/v2.0.0) on the first build. Linux needs the C++ runtime (`libstdc++`); macOS needs Xcode Command Line Tools and `libc++`. Cross-compilation is unsupported. Use `just` recipes or prefix Go commands with the wrapper: @@ -46,11 +46,10 @@ Alternatively configure your editor to launch `gopls` through `bash scripts/with-duckdb.sh gopls serve`. An already-running editor process must be restarted to inherit these variables. -The dependency mirror preserves the original DuckDB `v2.0.0-alpha46057` -archives at upstream commit `b15358c371` byte for byte. Its `duckdb-` tag -namespace is separate from Fanout's product CalVer releases; new engine bytes -require a new artifact tag and checksum pins. It never supplies a second engine -or downloads extensions at runtime. +The wrapper uses DuckDB's published static-library archives for upstream +commit `d54cbbe3df` and rejects any archive whose SHA-256 differs from its pin. +A new engine version requires new checksum pins. The wrapper never supplies a +second engine or downloads extensions at runtime. ## Before you open a pull request diff --git a/THIRD_PARTY_NOTICES b/THIRD_PARTY_NOTICES index 5e69f893..39b14c1e 100644 --- a/THIRD_PARTY_NOTICES +++ b/THIRD_PARTY_NOTICES @@ -73,7 +73,7 @@ COMPONENT INVENTORY - Go: modernc.org/mathutil v1.7.1 - Go: modernc.org/memory v1.12.1 - Go: modernc.org/sqlite v1.60.1 -- Native: DuckDB v2.0.0-alpha46057 (b15358c371) +- Native: DuckDB v2.0.0 (d54cbbe3df) - npm: @ag-ui/client 1.0.2 (declared license: MIT) - npm: @ag-ui/core 1.0.2 (declared license: MIT) - npm: @ag-ui/encoder 1.0.2 (declared license: MIT) @@ -5136,11 +5136,11 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --- Applies to ------------------------------------------------------------- -- Native: DuckDB v2.0.0-alpha46057 (b15358c371) / duckdb-NOTICE +- Native: DuckDB v2.0.0 (d54cbbe3df) / duckdb-NOTICE ---------------------------------------------------------------------------- -DuckDB b15358c371 — upstream license and bundled third-party notices. -Source: https://github.com/duckdb/duckdb/tree/b15358c371 +DuckDB d54cbbe3df — upstream license and bundled third-party notices. +Source: https://github.com/duckdb/duckdb/tree/d54cbbe3df --- LICENSE --- diff --git a/internal/duckdb/native.go b/internal/duckdb/native.go index 01492361..f58fc5c4 100644 --- a/internal/duckdb/native.go +++ b/internal/duckdb/native.go @@ -18,8 +18,8 @@ static int register_extensions(void) { */ import "C" -const Version = "v2.0.0-alpha46057" -const SourceCommit = "b15358c371" +const Version = "v2.0.0" +const SourceCommit = "d54cbbe3df" func init() { if C.GoString(C.duckdb_library_version()) != Version { diff --git a/internal/query/testdata/duckdb-functions.txt b/internal/query/testdata/duckdb-functions.txt index c5df5f5c..380038d2 100644 --- a/internal/query/testdata/duckdb-functions.txt +++ b/internal/query/testdata/duckdb-functions.txt @@ -1,4 +1,4 @@ -# engine v2.0.0-alpha46057 +# engine v2.0.0 != scalar !__postfix scalar !~~ scalar diff --git a/scripts/with-duckdb.sh b/scripts/with-duckdb.sh index 0e4ffa3f..992e2c60 100644 --- a/scripts/with-duckdb.sh +++ b/scripts/with-duckdb.sh @@ -3,26 +3,26 @@ set -euo pipefail root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" -version=v2.0.0-alpha46057 +version=v2.0.0 case "$(uname -s)/$(uname -m)" in Darwin/arm64) platform=osx-arm64 - checksum=e78e6a3ab5c35c1451650cdd234e9f42c8c9485412aaf063dfaae995f0dcda6a + checksum=c3a571e6d4a0da97534c631df463ab13c07f8cf78049625f5df936b7beaab9ce system_libs='-lc++ -Wl,-no_warn_duplicate_libraries' ;; Darwin/x86_64) platform=osx-amd64 - checksum=a1dd2b83754484dcd0980ed1c46d5726ec2a2fd26090d43341dc74f1060abff3 + checksum=7e6101ddc8de73e8dcc66f790e658e07891165d026992b40ceba20e50b01f8ec system_libs='-lc++ -Wl,-no_warn_duplicate_libraries' ;; Linux/x86_64) platform=linux-amd64 - checksum=4cb2df2e767f2a08fb38a0c39b8dadd1ad0eb07fd5cd6431092e709be41a323e + checksum=112d62c980f5447cd303a70b3dacbc09acd41ccb4ef6d154e8629f543a0f8568 system_libs='-lstdc++ -lm -ldl -pthread' ;; Linux/aarch64) platform=linux-arm64 - checksum=81cf834f18a7004d412862d25bbbd334c1e335432c94a2cbcb6c0f560ebbc3eb + checksum=8171b4842e68a85b2e82b342d3bf7b542a88fd6666e0c18438d7b459012494ee system_libs='-lstdc++ -lm -ldl -pthread' ;; *) @@ -53,7 +53,7 @@ if [[ ! -f "$libs/.verified" ]]; then if [[ ! -f "$libs/.verified" ]]; then stage="$(mktemp -d "$(dirname "$libs")/.download.XXXXXX")" trap 'rm -rf "$stage"; rmdir "$lock"' EXIT - url="https://github.com/labstack/fanout/releases/download/duckdb-$version/duckdb-static-libs-$platform.tar.gz" + url="https://github.com/duckdb/duckdb/releases/download/$version/duckdb-static-libs-$platform.tar.gz" curl --fail --location --silent --show-error "$url" -o "$stage/archive.tar.gz" if [[ "$platform" == osx-* ]]; then actual="$(shasum -a 256 "$stage/archive.tar.gz" | awk '{print $1}')" diff --git a/site/src/content/docs/explanation/storage-model.mdx b/site/src/content/docs/explanation/storage-model.mdx index 684708ad..0add28c2 100644 --- a/site/src/content/docs/explanation/storage-model.mdx +++ b/site/src/content/docs/explanation/storage-model.mdx @@ -98,7 +98,7 @@ string encoding when querying them for a JSON client. ## Engine and format are pinned -Fanout embeds DuckDB `v2.0.0-alpha46057`, a preview engine, with its extensions +Fanout embeds DuckDB `v2.0.0`, the 2.0 LTS release, with its extensions compiled into the binary. It downloads no extensions at runtime. Native source builds use `scripts/with-duckdb.sh`, which checks the platform archive and uses the matching engine headers; the ordinary `just` build and test recipes invoke diff --git a/third_party/notices/duckdb-NOTICE.txt b/third_party/notices/duckdb-NOTICE.txt index c0888af8..2fd2c180 100644 --- a/third_party/notices/duckdb-NOTICE.txt +++ b/third_party/notices/duckdb-NOTICE.txt @@ -1,5 +1,5 @@ -DuckDB b15358c371 — upstream license and bundled third-party notices. -Source: https://github.com/duckdb/duckdb/tree/b15358c371 +DuckDB d54cbbe3df — upstream license and bundled third-party notices. +Source: https://github.com/duckdb/duckdb/tree/d54cbbe3df --- LICENSE ---