Product Artifacts

Each release artifact has one deployment purpose. Use <version> as the version delivered through your approved distribution channel.

Primary deliverables

Deliverable	Artifact	Use
CLI	postq-code-scanner-cli-<version>.zip	Native scans, scripts, and CI runners
VS Code	postq-code-scanner-vscode-<version>.vsix	Developer scanning and source-linked review
Eclipse	postq-code-scanner-eclipse-plugin-<version>.zip	Installable Eclipse or Spring Tools plugin for scanning and review
Report Viewer	Included in postq-code-scanner-cli-<version>.zip under report-viewer/index.html	Read completed reports without scanning
Prerequisite Check	postq-code-scanner-prereq-check-<version>.zip	Readiness diagnostics and guided dependency setup
Container archive	postq-code-scanner-cli-oci-image-<version>.tar	Air-gapped or local OCI image transfer

Container evidence

Artifact	Purpose
postq-code-scanner-cli-container-<version>.json	Image name, tag, platforms, and pinned component metadata
postq-code-scanner-cli-container-hardening-<version>.json	Final-image hardening checks
postq-code-scanner-cli-container-security-scan-<version>.json	Security scan execution evidence
postq-code-scanner-cli-container-sbom-<version>.cdx.json	Container software bill of materials
postq-code-scanner-cli-container-trivy-<version>.json	Trivy vulnerability scan result
postq-code-scanner-cli-container-signature-verification-<version>.json	Optional Cosign verification evidence

These files describe the supplied container image. They do not replace the organization's own admission policy, registry controls, vulnerability decisions, or signature verification.

Artifact handling

• Obtain artifacts only from the approved PostQ distribution channel.
• Keep the artifact and its supplied integrity/evidence files together.
• Verify hashes and signatures according to the instructions supplied with that release.
• Store postq.lic separately; it is not part of any product archive.
• Retain the license, product terms, beta notice, third-party notices, and source information that ship with the exact artifact.
• Do not redistribute artifacts or legal files beyond the rights in the applicable agreement.

Report Viewer usage

Copy report-viewer/index.html from the extracted CLI distribution into a generated report folder and open that copied file. Use Load Folder for a complete output directory or Load Files for selected JSON reports. The viewer is self-contained and does not require a local web server.

Container distribution

Use a registry-published multi-platform manifest list when both linux/amd64 and linux/arm64 are required. Use the tar archive for a specific platform in local or air-gapped transfer. Pin approved production deployments by digest where the distribution channel provides one.