Product Artifacts

Each release artifact has one deployment purpose. Use <version> as the version delivered through your approved distribution channel.

Primary deliverables

Deliverable	Artifact	Use
CLI	postq-code-scanner-cli-<version>.zip	Native scans, scripts, and CI runners
VS Code	postq-code-scanner-vscode-<version>.vsix	Developer scanning and source-linked review
Eclipse	postq-code-scanner-eclipse-plugin-<version>.zip	Eclipse/Spring Tools scanning and review
Report Viewer	postq-code-scanner-report-viewer-<version>.zip	Read completed reports without scanning
Prerequisite Check	postq-code-scanner-prereq-check-<version>.zip	Readiness diagnostics and guided dependency setup
Container archive	postq-code-scanner-cli-oci-image-<version>.tar	Air-gapped or local OCI image transfer

Container evidence

Artifact	Purpose
postq-code-scanner-cli-container-<version>.json	Image name, tag, platforms, and pinned component metadata
postq-code-scanner-cli-container-hardening-<version>.json	Final-image hardening checks
postq-code-scanner-cli-container-security-scan-<version>.json	Security scan execution evidence
postq-code-scanner-cli-container-sbom-<version>.cdx.json	Container software bill of materials
postq-code-scanner-cli-container-trivy-<version>.json	Trivy vulnerability scan result
postq-code-scanner-cli-container-signature-verification-<version>.json	Optional Cosign verification evidence

Evidence files describe the built image and release process. They do not replace the organization's own admission policy, registry controls, vulnerability decisions, or signature verification.

Artifact handling

• Obtain artifacts only from the approved PostQ distribution channel.
• Keep the artifact and its supplied integrity/evidence files together.
• Verify hashes and signatures according to the instructions supplied with that release.
• Store postq.lic separately; it is not part of any product archive.
• Retain the license, product terms, beta notice, third-party notices, and source information that ship with the exact artifact.
• Do not redistribute artifacts or legal files beyond the rights in the applicable agreement.

Report Viewer usage

Extract the viewer and open index.html. Use Load Folder for a complete output directory or Load Files for selected JSON reports. The viewer is self-contained and does not require a local web server.

Container distribution

Use a registry-published multi-platform manifest list when both linux/amd64 and linux/arm64 are required. Use the tar archive for a specific platform in local or air-gapped transfer. Pin approved production deployments by digest where the distribution channel provides one.