databricks-sql-kernel 0.3.0__tar.gz → 1.1.0__tar.gz

databricks_sql_kernel-1.1.0/.github/scripts/check-release-debuginfo.ps1

@@ -0,0 +1,154 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+function Invoke-Checked {
+    param(
+        [Parameter(Mandatory = $true)][string]$FilePath,
+        [Parameter(Mandatory = $false)][AllowEmptyCollection()][string[]]$Arguments = @()
+    )
+
+    & $FilePath @Arguments
+    if ($LASTEXITCODE -ne 0) {
+        throw "command failed with exit code ${LASTEXITCODE}: $FilePath $($Arguments -join ' ')"
+    }
+}
+
+function Find-AsciiMatch {
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][regex]$Pattern
+    )
+
+    $buffer = [byte[]]::new(65536)
+    $tail = ""
+    $stream = [System.IO.File]::OpenRead($Path)
+    try {
+        while (($bytesRead = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) {
+            $chunk = $tail + [System.Text.Encoding]::ASCII.GetString($buffer, 0, $bytesRead)
+            $match = $Pattern.Match($chunk)
+            if ($match.Success) {
+                return $match.Value
+            }
+            $tailLength = [Math]::Min(1024, $chunk.Length)
+            $tail = $chunk.Substring($chunk.Length - $tailLength)
+        }
+    } finally {
+        $stream.Dispose()
+    }
+    return $null
+}
+
+$profileName = "release-with-debuginfo"
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot "../..")).Path
+$targetRoot = if ($env:CARGO_TARGET_DIR) {
+    [System.IO.Path]::GetFullPath($env:CARGO_TARGET_DIR, $repoRoot)
+} else {
+    Join-Path $repoRoot "target"
+}
+$profileDir = Join-Path $targetRoot $profileName
+$source = Join-Path $repoRoot "tests/symbols/staticlib_consumer.c"
+$includeDir = Join-Path $repoRoot "include"
+$archive = Join-Path $profileDir "databricks_sql_kernel.lib"
+$object = Join-Path $profileDir "staticlib_consumer.obj"
+$executable = Join-Path $profileDir "kernel-symbol-smoke.exe"
+$pdb = Join-Path $profileDir "kernel-symbol-smoke.pdb"
+
+New-Item -ItemType Directory -Force -Path $profileDir | Out-Null
+Push-Location $repoRoot
+try {
+    # Build the exact static archive under test and capture the MSVC system
+    # libraries that rustc says its final native linker must receive.
+    # The toolchain action enables color globally; disable it here so ANSI reset
+    # bytes cannot become part of the parsed final library argument.
+    $env:CARGO_TERM_COLOR = "never"
+    $buildLines = @(& cargo rustc --locked --profile $profileName --lib -- --print=native-static-libs 2>&1)
+    $buildExit = $LASTEXITCODE
+    $buildLines | ForEach-Object { Write-Host $_ }
+    if ($buildExit -ne 0) {
+        throw "cargo rustc failed with exit code $buildExit"
+    }
+    if (-not (Test-Path -LiteralPath $archive -PathType Leaf)) {
+        throw "Cargo did not produce $archive"
+    }
+
+    $nativeLine = $buildLines |
+        ForEach-Object { "$_" } |
+        Where-Object { $_ -match "native-static-libs:\s*(.+)$" } |
+        Select-Object -Last 1
+    if (-not $nativeLine) {
+        throw "rustc did not report native-static-libs"
+    }
+    $nativeText = ([regex]::Match($nativeLine, "native-static-libs:\s*(.+)$")).Groups[1].Value.Trim()
+    $nativeLinkArgs = @($nativeText -split "\s+" | Where-Object { $_ })
+
+    Invoke-Checked "cl.exe" @(
+        "/nologo", "/c", "/O2", "/MD", "/Z7", "/I$includeDir", $source, "/Fo$object"
+    )
+    $linkArgs = @(
+        "/NOLOGO", "/DEBUG:FULL", "/OPT:REF", "/OPT:ICF", "/INCREMENTAL:NO",
+        "/PDB:$pdb", "/PDBALTPATH:%_PDB%", "/OUT:$executable",
+        $object, $archive
+    ) + $nativeLinkArgs
+    Invoke-Checked "link.exe" $linkArgs
+    if (-not (Test-Path -LiteralPath $pdb -PathType Leaf)) {
+        throw "link.exe did not produce $pdb"
+    }
+    Invoke-Checked $executable @()
+
+    if (-not (Get-Command "dumpbin.exe" -ErrorAction SilentlyContinue)) {
+        throw "dumpbin.exe is required to validate the executable/PDB CodeView identity"
+    }
+
+    $functionPattern = [regex]::new("kernel_get_last_error")
+    $sourcePattern = [regex]::new("(?i)src[\\/]c_abi[\\/]error\.rs")
+    if (-not (Find-AsciiMatch $pdb $functionPattern)) {
+        throw "PDB does not describe kernel_get_last_error"
+    }
+    if (-not (Find-AsciiMatch $pdb $sourcePattern)) {
+        throw "PDB does not name src/c_abi/error.rs"
+    }
+
+    # The PE carries only the CodeView locator/identity; source and function
+    # records stay in the separately published PDB. In an isolated directory,
+    # dumpbin reports the adjacent PDB only when its GUID and age match the PE.
+    $checkDir = Join-Path ([System.IO.Path]::GetTempPath()) ("kernel-pdb-check-" + [guid]::NewGuid().ToString("N"))
+    New-Item -ItemType Directory -Path $checkDir | Out-Null
+    try {
+        $checkExe = Join-Path $checkDir (Split-Path -Leaf $executable)
+        $checkPdb = Join-Path $checkDir (Split-Path -Leaf $pdb)
+        Copy-Item -LiteralPath $executable -Destination $checkExe
+        Copy-Item -LiteralPath $pdb -Destination $checkPdb
+
+        $lookup = @(& dumpbin.exe /NOLOGO /PDBPATH $checkExe 2>&1)
+        $lookupExit = $LASTEXITCODE
+        $lookupText = $lookup | Out-String
+        Write-Host $lookupText
+        if ($lookupExit -ne 0) {
+            throw "dumpbin /PDBPATH failed with exit code $lookupExit"
+        }
+        if ($lookupText -notmatch [regex]::Escape($checkPdb)) {
+            throw "dumpbin did not resolve the supplied PDB; its GUID/age may not match the executable"
+        }
+    } finally {
+        Remove-Item -LiteralPath $checkDir -Recurse -Force -ErrorAction SilentlyContinue
+    }
+
+    Write-Host "ok: Windows PDB contains kernel Rust source/function info"
+    Write-Host "ok: dumpbin validated the executable/PDB CodeView GUID and age"
+} finally {
+    Pop-Location
+}

databricks_sql_kernel-1.1.0/.github/scripts/check-release-debuginfo.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+readonly PROFILE="release-with-debuginfo"
+readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+readonly TARGET_ROOT="${CARGO_TARGET_DIR:-${REPO_ROOT}/target}"
+readonly PROFILE_DIR="${TARGET_ROOT}/${PROFILE}"
+readonly CONSUMER_SOURCE="${REPO_ROOT}/tests/symbols/staticlib_consumer.c"
+readonly ARCHIVE="${PROFILE_DIR}/libdatabricks_sql_kernel.a"
+readonly CONSUMER="${PROFILE_DIR}/kernel-symbol-smoke"
+
+for command in cargo cc; do
+  if ! command -v "${command}" >/dev/null 2>&1; then
+    echo "FAIL: required command not found: ${command}" >&2
+    exit 1
+  fi
+done
+
+mkdir -p "${PROFILE_DIR}"
+build_log="$(mktemp)"
+trap 'rm -f "${build_log}"' EXIT
+
+# Cargo prints the platform libraries a C/C++ final linker must add when it
+# consumes this staticlib. Capture that list while building the exact archive
+# under test.
+CARGO_TERM_COLOR=never cargo rustc --locked --profile "${PROFILE}" --lib -- \
+  --print=native-static-libs 2>&1 | tee "${build_log}"
+
+if [[ ! -f "${ARCHIVE}" ]]; then
+  echo "FAIL: Cargo did not produce ${ARCHIVE}" >&2
+  exit 1
+fi
+
+native_link_line="$(sed -n 's/^note: native-static-libs: //p' "${build_log}" | tail -n 1)"
+if [[ -z "${native_link_line}" ]]; then
+  echo "FAIL: rustc did not report native-static-libs" >&2
+  exit 1
+fi
+read -r -a native_link_args <<<"${native_link_line}"
+
+case "$(uname -s)" in
+  Linux)
+    for command in objcopy readelf; do
+      if ! command -v "${command}" >/dev/null 2>&1; then
+        echo "FAIL: required command not found: ${command}" >&2
+        exit 1
+      fi
+    done
+
+    debug_file="${CONSUMER}.debug"
+    cc -O2 -I "${REPO_ROOT}/include" "${CONSUMER_SOURCE}" "${ARCHIVE}" \
+      "${native_link_args[@]}" -Wl,--build-id=sha1 -o "${CONSUMER}"
+    "${CONSUMER}"
+
+    # This mirrors consumer packaging: retain full DWARF in the private symbol
+    # artifact, strip it from the customer executable, and leave only the GNU
+    # debug-link locator/checksum in the shipped file.
+    objcopy --only-keep-debug "${CONSUMER}" "${debug_file}"
+    objcopy --strip-debug "${CONSUMER}"
+    objcopy --add-gnu-debuglink="${debug_file}" "${CONSUMER}"
+
+    if readelf --sections "${CONSUMER}" | \
+      grep -E '\.debug_(abbrev|info|line|str)' >/dev/null; then
+      echo "FAIL: customer executable still contains DWARF sections" >&2
+      exit 1
+    fi
+    if ! readelf --sections "${CONSUMER}" | grep -F '.gnu_debuglink' >/dev/null; then
+      echo "FAIL: customer executable has no .gnu_debuglink" >&2
+      exit 1
+    fi
+
+    dwarf_dump="${PROFILE_DIR}/kernel-symbol-smoke.dwarf.txt"
+    line_dump="${PROFILE_DIR}/kernel-symbol-smoke.lines.txt"
+    readelf --debug-dump=info "${debug_file}" >"${dwarf_dump}"
+    readelf --debug-dump=decodedline "${debug_file}" >"${line_dump}"
+    if ! grep -Fq 'kernel_get_last_error' "${dwarf_dump}"; then
+      echo "FAIL: split DWARF does not describe kernel_get_last_error" >&2
+      exit 1
+    fi
+    if ! grep -Fq 'src/c_abi/error.rs' "${line_dump}"; then
+      echo "FAIL: split DWARF does not name src/c_abi/error.rs" >&2
+      exit 1
+    fi
+
+    binary_notes="$(readelf --notes "${CONSUMER}")"
+    debug_notes="$(readelf --notes "${debug_file}")"
+    binary_id="$(sed -n 's/.*Build ID: //p' <<<"${binary_notes}")"
+    debug_id="$(sed -n 's/.*Build ID: //p' <<<"${debug_notes}")"
+    if [[ -z "${binary_id}" || "${binary_id}" != "${debug_id}" ]]; then
+      echo "FAIL: executable and split DWARF build IDs do not match" >&2
+      exit 1
+    fi
+
+    echo "ok: Linux split DWARF contains kernel Rust source/function info"
+    echo "ok: executable and .debug share build ID ${binary_id}"
+    ;;
+  Darwin)
+    for command in dsymutil otool strip xcrun; do
+      if ! command -v "${command}" >/dev/null 2>&1; then
+        echo "FAIL: required command not found: ${command}" >&2
+        exit 1
+      fi
+    done
+
+    dsym="${CONSUMER}.dSYM"
+    cc -O2 -I "${REPO_ROOT}/include" "${CONSUMER_SOURCE}" "${ARCHIVE}" \
+      "${native_link_args[@]}" -o "${CONSUMER}"
+    "${CONSUMER}"
+    dsymutil "${CONSUMER}" -o "${dsym}"
+    strip -S "${CONSUMER}"
+
+    if otool -l "${CONSUMER}" | grep -F '__DWARF' >/dev/null; then
+      echo "FAIL: customer executable still contains a __DWARF segment" >&2
+      exit 1
+    fi
+
+    dwarf_dump="${PROFILE_DIR}/kernel-symbol-smoke.dwarf.txt"
+    dwarf_file="${dsym}/Contents/Resources/DWARF/$(basename "${CONSUMER}")"
+    if [[ ! -f "${dwarf_file}" ]]; then
+      echo "FAIL: dsymutil did not produce ${dwarf_file}" >&2
+      exit 1
+    fi
+    xcrun dwarfdump --name kernel_get_last_error "${dsym}" >"${dwarf_dump}"
+    if ! grep -Fq 'kernel_get_last_error' "${dwarf_dump}"; then
+      echo "FAIL: dSYM does not describe kernel_get_last_error" >&2
+      exit 1
+    fi
+    if ! grep -Eq 'DW_AT_decl_file.*error\.rs' "${dwarf_dump}"; then
+      echo "FAIL: kernel_get_last_error has no error.rs source record in the dSYM" >&2
+      exit 1
+    fi
+
+    binary_uuid_dump="$(xcrun dwarfdump --uuid "${CONSUMER}")"
+    dsym_uuid_dump="$(xcrun dwarfdump --uuid "${dsym}")"
+    binary_uuid="$(awk 'NR == 1 { print $2 }' <<<"${binary_uuid_dump}")"
+    dsym_uuid="$(awk 'NR == 1 { print $2 }' <<<"${dsym_uuid_dump}")"
+    if [[ -z "${binary_uuid}" || "${binary_uuid}" != "${dsym_uuid}" ]]; then
+      echo "FAIL: executable and dSYM UUIDs do not match" >&2
+      exit 1
+    fi
+
+    echo "ok: macOS dSYM contains kernel Rust source/function info"
+    echo "ok: executable and dSYM share UUID ${binary_uuid}"
+    ;;
+  *)
+    echo "FAIL: unsupported platform for this check: $(uname -s)" >&2
+    exit 1
+    ;;
+esac

databricks_sql_kernel-1.1.0/.github/workflows/release-debuginfo.yml

@@ -0,0 +1,138 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Release Debuginfo
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [main]
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  # Hosted macOS runners cannot check out this private repository through the
+  # org IP allow list. Hand the same checked-out source to macOS through the
+  # Actions artifact service, which is not allow-list gated.
+  macos-source:
+    name: Source handoff (macOS)
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: [linux-ubuntu-latest]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: repo-src
+
+      - name: Archive source
+        shell: bash
+        run: |
+          set -euo pipefail
+          tar czf repo-source.tar.gz -C repo-src --exclude='.git' .
+
+      - name: Upload source
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-debuginfo-source
+          path: repo-source.tar.gz
+          retention-days: 1
+          if-no-files-found: error
+
+  linux:
+    name: Linux split DWARF
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: [linux-ubuntu-latest]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+
+      - name: Verify split DWARF
+        shell: bash
+        run: bash .github/scripts/check-release-debuginfo.sh
+
+  macos:
+    name: macOS dSYM
+    needs: macos-source
+    runs-on: macos-15
+    timeout-minutes: 45
+    steps:
+      - name: Download source
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-debuginfo-source
+
+      - name: Unpack source
+        shell: bash
+        run: |
+          set -euo pipefail
+          tar xzf repo-source.tar.gz -C "$GITHUB_WORKSPACE"
+          rm -f repo-source.tar.gz
+          test -f Cargo.toml
+
+      - uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+
+      - name: Verify dSYM
+        shell: bash
+        run: bash .github/scripts/check-release-debuginfo.sh
+
+  windows:
+    name: Windows linker PDB
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: [windows-server-latest]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+
+      - name: Set up MSVC environment
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
+        with:
+          arch: x64
+
+      - name: Verify linker PDB
+        shell: pwsh
+        run: ./.github/scripts/check-release-debuginfo.ps1

{databricks_sql_kernel-0.3.0 → databricks_sql_kernel-1.1.0}/CHANGELOG.md

@@ -14,6 +14,35 @@ cadences and may not move in lockstep with the crate.
 
 ### Fixed
 
+## [v1.1.0] - 2026-09-23
+
+### Added
+- Execution-scoped client query deadlines for Rust and C APIs.
+- FAST-mode session version exchange.
+- C ABI query tags, HTTP connection limits, connection-test deadlines, and
+  result-stream cancellation.
+- Release-with-debuginfo build profile and native symbol checks.
+
+### Changed
+- Client deadlines permit an in-flight status request five seconds to finish.
+- Direct traffic identifies itself as Databricks SQL Kernel.
+- rustls now includes OS trust roots.
+- Updated rustls to remediate OSV findings.
+
+### Fixed
+- CloudFetch downloads have end-to-end deadlines and terminal link-fetch
+  errors.
+- C ABI workers preserve a two-MiB stack floor without shrinking larger
+  configured stacks.
+- mTLS rejects non-HTTPS endpoints.
+- PAT telemetry omits OAuth auth-flow metadata.
+
+## [v1.0.0] - 2026-08-31
+
+### Fixed
+- Explicit async statement close finalizes telemetry when a partially consumed
+  result stream remains alive.
+
 ## [v0.3.0] - 2026-08-28
 
 ### Added

{databricks_sql_kernel-0.3.0 → databricks_sql_kernel-1.1.0}/Cargo.lock

@@ -617,7 +617,7 @@ checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
 [[package]]
 name = "databricks-sql-kernel"
-version = "0.3.0"
+version = "1.1.0"
 dependencies = [
  "aes 0.9.2",
  "arrow-array",
@@ -1199,6 +1199,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "rustls",
+ "rustls-native-certs",
  "tokio",
  "tokio-rustls",
  "tower-service",
@@ -2231,6 +2232,7 @@ dependencies = [
  "pin-project-lite",
  "quinn",
  "rustls",
+ "rustls-native-certs",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -2334,9 +2336,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.41"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "once_cell",
  "ring",
@@ -2346,6 +2348,18 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
 [[package]]
 name = "rustls-pki-types"
 version = "1.15.0"
@@ -2358,9 +2372,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",

{databricks_sql_kernel-0.3.0 → databricks_sql_kernel-1.1.0}/Cargo.toml

@@ -14,7 +14,7 @@
 
 [package]
 name = "databricks-sql-kernel"
-version = "0.3.0"
+version = "1.1.0"
 edition = "2021"
 authors = ["Databricks"]
 license = "Apache-2.0"
@@ -193,7 +193,17 @@ tokio-rustls = { version = "0.26.4", default-features = false, features = ["ring
 [features]
 default = ["tls-native"]
 tls-native = ["reqwest/native-tls"]
-tls-rustls = ["reqwest/rustls-tls"]
+# `rustls-tls` alone is `reqwest/rustls-tls-webpki-roots` — the bundled Mozilla
+# root set only, which does NOT read the OS system trust store. `tls-native`
+# (native-tls → OpenSSL) DOES read `/etc/ssl/...`, so a `tls-rustls` build behind
+# a private/internal CA installed only in the OS store fails a handshake that the
+# `tls-native` build completes. Enabling `rustls-tls-native-roots` alongside makes
+# reqwest load the OS trust store AND the Mozilla bundled roots into one
+# `RootCertStore` (both `tls_built_in_certs_*` default true → additive, no
+# fallback lost). This gives the aarch64 cross-build — the only Linux arch on
+# `tls-rustls` — system-CA parity with the x86_64/i686 OpenSSL builds. See
+# odbc#323.
+tls-rustls = ["reqwest/rustls-tls", "reqwest/rustls-tls-native-roots"]
 
 [lib]
 name = "databricks_sql_kernel"
@@ -213,3 +223,11 @@ crate-type = ["lib", "cdylib", "staticlib"]
 # workspace views (kernel root, pyo3, napi).
 [workspace]
 members = ["."]
+
+# Opt-in profile for native consumers that split private crash symbols from the
+# shipped driver. Inheriting `release` is intentional: `debug` is the only
+# override, so optimization, LTO, codegen units, panic behavior, overflow
+# checks, and debug assertions remain identical to an ordinary release build.
+[profile.release-with-debuginfo]
+inherits = "release"
+debug = 2

{databricks_sql_kernel-0.3.0 → databricks_sql_kernel-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: databricks-sql-kernel
-Version: 0.3.0
+Version: 1.1.0
 Requires-Dist: pyarrow>=23.0.1,<24 ; python_full_version >= '3.10'
 Requires-Dist: pyarrow>=14,<19 ; python_full_version < '3.10'
 Summary: Python bindings for the Databricks SQL Kernel (PyO3)

{databricks_sql_kernel-0.3.0 → databricks_sql_kernel-1.1.0}/README.md

@@ -37,6 +37,11 @@ cargo test
 make check    # fmt + clippy + tests
 ```
 
+Native consumers that statically link the kernel and publish separate crash
+symbols can use the opt-in `release-with-debuginfo` profile. See
+[`docs/release-debuginfo.md`](docs/release-debuginfo.md) for build, symbol
+splitting, packaging, and binary-identity guidance.
+
 ## Configuration
 
 See [CONNECTION_PARAMETERS.md](CONNECTION_PARAMETERS.md) for every connection, auth, and session parameter the kernel accepts — its meaning, default value, and the config struct it lives on.