Prebuilt binaries for four targets, a pushed container image, and checksums for both

Status

To do

Component

release

Priority

High — nobody installs this today without a Go toolchain

Blocked by

SAPE-1

Blocks

SAPE-5

Description

Produce sapedbd and sapedb binaries for linux and macos on both amd64 and arm64 — four targets, two binaries each — and push a container image to a registry. Every artefact gets a checksum published alongside it. The version from SAPE-1 is stamped into each binary at link time, so a downloaded file can say what it is.

Why now

This is the "a stranger cannot install it" category, and it is the whole of it. Today the only way to get a running sapedb is to have Go, clone the repository, and build. That is not an install path, it is a development setup, and it filters out everyone who wanted to try the database rather than work on it.

Measured 2026-09-20. packages/sapedb/Dockerfile exists and builds a working image — a scratch final stage with a single static binary. But it builds for one platform only: there is no TARGETPLATFORM, GOOS or GOARCH anywhere in it, and the build line is a plain RUN go build -trimpath -ldflags="-s -w" -o /sapedbd ./cmd/sapedbd (Dockerfile:18) with no -X to stamp a version into. Makefile has an image target that is docker build -t sapedb:latest . — local tag, no push, no manifest list, no checksum. And ls packages/sapedb/.github returns No such file or directory: there is no directory, so there is nothing to run any of this.

Acceptance criteria

1. Eight binaries are published for one tag: sapedbd and sapedb for linux/amd64, linux/arm64, darwin/amd64, darwin/arm64.
2. Each published binary, run on its own platform, prints the tag it was built from via sapedb version. Four targets means four machines or four emulated runs; a build that was never executed does not count.
3. A checksum file covers every published artefact. Recomputing the checksum of a downloaded file matches the published one — run as a command, not read off a page.
4. The container image is pullable by tag from the registry under a manifest list covering amd64 and arm64, and docker run <image> version prints the same tag.
5. Measured from a shell that has never had Go installed. If the check needs the repository checked out, it has not tested the thing this ticket is about.

Out of scope

• Windows. No client has been run there, no test has, and adding a target nobody has exercised adds a support surface rather than a user.
• Packages for apt, brew, or any distribution. A tarball and an image are what SAPE-5 needs; the rest is convenience after somebody asks.
• Signing or notarizing the desktop build. That is on the v1.1 list on purpose — it blocks the app on a second machine, not the server.
• The workflow that triggers all this. That is SAPE-4; this ticket is what the workflow produces.