Observer 0.24.2

Observer 0.24.2.

Linux: sudo observer rotate-key could leave the service unable to start

Linux (.deb) only, every release since 0.1.2. The Windows package is not affected: it gives the store an explicit permission list when the file is created, and that list names SYSTEM, the account the service runs as, whoever creates the file.

What was wrong. The service runs as the observer account and keeps its machine token in /etc/observer/credentials.json. sudo observer rotate-key runs as root, and the file it wrote to replace the token belonged to root. The account the service runs as could no longer read its own store: the running service carried on, but its next start failed and it restarted in a loop until the file was repaired by hand. Since 0.24.0, observer rotate-key --now also reported DID NOT APPLY and advised restarting the service, which is the step that made it fail.

Are you affected? If you ran sudo observer rotate-key on a Linux machine with an earlier .deb. ls -l /etc/observer/credentials.json shows it: the owner is root instead of observer.

What to do. Install the .deb attached to this release. Upgrading gives the file back to observer before it restarts the service, so a machine already in that state starts working again. Without upgrading:

sudo chown observer:observer /etc/observer/credentials.json
sudo systemctl restart observer

The file holds the token the rotation wrote, so the service uses that one once it runs again; sudo observer share prints it.

After upgrading. sudo observer rotate-key leaves the store owned by observer. If root cannot hand the new file over, the command stops with an error, says nothing was rotated, and the store that was working stays as it was.

The packages are NOT signed

Windows will say so twice, in two different ways, and the two are not fixed
by the same thing:

• User Account Control will show "Unknown publisher". A signature removes
  this immediately, from the first download;
• SmartScreen will warn on first run of the installer. A signature does
  NOT remove this: since March 2024 not even an EV certificate bypasses it.
  It depends on how many clean downloads the file has accumulated, not on the
  certificate it carries.

To go ahead: More info, then Run anyway.

Where this package comes from

Every attached file carries a provenance attestation signed by GitHub, which
ties it to the commit and the workflow that produced it:

gh attestation verify Observer.msi --repo Akr0n/observer

It is not an Authenticode signature and Windows does not look at it. It answers
a different and equally useful question: does this file really come from that
source code, rather than does Windows trust whoever made it.

Windows

Installs the service, the dashboard and the command line. Needs an elevated terminal:

msiexec /i Observer.msi

Nothing else needs installing: the package bundles the .NET runtime, which is
why it weighs about fifty megabytes. Up to 0.2.0 it required ASP.NET Core 10
without checking that it was there, and on a machine without it the service
died at startup while the installer talked about insufficient privileges - a
cause that had nothing to do with the real one.

Note that this means the runtime's security fixes no longer come from
Windows Update. They come with a new Observer release.

If that machine already has an Observer service registered by hand, remove it
first, and empty the installation folder.

Linux

sudo apt install ./observer_0.24.2_amd64.deb

Requires Ubuntu 24.04 or later: aspnetcore-runtime-10.0 comes from the official
archive, so the runtime is not bundled and is updated with the system.

After installing

To watch the machine you are sitting at there is nothing to configure, and no token
is needed: the dashboard uses the local channel. The token and the certificate
fingerprint are needed only so that ANOTHER computer can query this one, and you get
them with observer share.