Downloads
First release pending. The artifacts below are published only as GitHub Releases — there is no Maven Central, no npm registry, and no SPM registry. The release workflow that produces this matrix is being rehearsed; when the first tag is published, the links on this page resolve to the released assets, in the exact file names the table lists.
Artifact matrix
| Platform | Artifact file | Status | What it contains |
|---|---|---|---|
| Android | rustic-maps-sdk-android-vX.Y.Z.aar | shipped | Kotlin bindings plus the Rust library for arm64-v8a, armeabi-v7a, x86_64 |
| iOS | rustic-maps-sdk-ios-vX.Y.Z.xcframework.zip | shipped | The XCFramework (arm64 device and simulator slices), packaged for a Swift Package Manager binary target |
| WebAssembly | rustic-maps-sdk-web-vX.Y.Z.tar.gz (raw pkg/) and rustic-maps-sdk-web-vX.Y.Z.tgz (npm) | shipped | The wasm module, its JavaScript shim and both type files; the npm package adds the manifest, licenses and notices |
| React Native | rustic-maps-sdk-rn-vX.Y.Z.tgz (npm, @angoratek/rustic-maps-sdk) | shipped (source package) | The TurboModule package: generated TypeScript, JSI C++, podspec and CMake glue; the native Rust payload lands with the build-rn pipeline item |
| All platforms | rustic-maps-sdk-notices-vX.Y.Z.md | shipped | The third-party dependency notices that accompany your own distribution |
What accompanies every release
Every release carries a per-asset .sha256 sidecar, the aggregated
SHA256SUMS.txt manifest covering all assets, and a Sigstore signature
bundle (.sigstore.json) per asset and for SHA256SUMS.txt itself. The
release is immutable: a problem is fixed by a new tag, never by
replacing an asset.
Verifying an artifact
Verify the checksum first, then the signature. The signature bundles
bind the asset to the release workflow and the vX.Y.Z tag, so the
verification command pins both:
sha256sum --check SHA256SUMS.txt --ignore-missing
cosign verify-blob <artifact-file> \
--bundle <artifact-file>.sigstore.json \
--certificate-identity-regexp \
"https://github.com/angoratek/rustic-maps-sdk/.github/workflows/release.yml@refs/tags/vX.Y.Z" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--yes
The --ignore-missing flag keeps the sha256sum run to the files you
actually downloaded.
Installing from a release
The tutorials carry the per-platform install steps
against these exact artifact names: the checked-in AAR path for Android,
the checksummed zip for the Swift Package Manager binary target, and the
pkg/ archive for the wasm package. The npm packages ship the same
generated trees with a manifest, licenses and notices; the React Native
package is source-only until its native payload joins the release pipeline.