Observer 0.24.4

Observer 0.24.4.

Windows: a corrected recovery line, and what a refused start looks like

Windows only. The Linux package changes only in its version number.

What was wrong. When the service refuses a credential folder that nothing vouches for (0.24.1 and later), the message it writes to the Windows Application log tells you, if Windows will not let you delete the folder, to run takeown /F "<folder>" /A /R /D Y. The /D option takes the letter for "yes" of the language of Windows, so on every Windows that is not English the Y is rejected with a syntax error and the line does nothing. It now says takeown /F "<folder>" /A /R, and that takeown may ask a yes/no question in the language of Windows: answer yes.

What else changes in that message. A folder the service cannot list counts as not empty. An empty folder whose owner took SYSTEM out of its permissions was refused with "is not empty" and sent whoever read it looking for files that are not there; the message now says why, and observer doctor says that the service does not replace such a folder. The recovery is the same three icacls lines as for any refused folder, in the README under Packages.

What a refusal looks like, measured. On a real machine, with the recovery actions the package sets (restart after five seconds) applied by hand to a throwaway service, Windows did not retry a refused start in the 40 seconds that were watched: starting the service waited about 30 seconds and failed with error 1053, and the reason was in the Application log (source .NET Runtime, event 1026) and nowhere the System log points to. The service stayed stopped for as long as it was watched, so plan on starting it yourself once the folder is fixed. Not tried: a service that crashes after it has started, the start at boot, and an MSI upgrade that rolls back with error 1920.

No action needed. Nothing about the token, the certificate or who can read them changes.

The packages are NOT signed

Windows will say so twice, in two different ways, and the two are not fixed
by the same thing:

• User Account Control will show "Unknown publisher". A signature removes
  this immediately, from the first download;
• SmartScreen will warn on first run of the installer. A signature does
  NOT remove this: since March 2024 not even an EV certificate bypasses it.
  It depends on how many clean downloads the file has accumulated, not on the
  certificate it carries.

To go ahead: More info, then Run anyway.

Where this package comes from

Every attached file carries a provenance attestation signed by GitHub, which
ties it to the commit and the workflow that produced it:

gh attestation verify Observer.msi --repo Akr0n/observer

It is not an Authenticode signature and Windows does not look at it. It answers
a different and equally useful question: does this file really come from that
source code, rather than does Windows trust whoever made it.

Windows

Installs the service, the dashboard and the command line. Needs an elevated terminal:

msiexec /i Observer.msi

Nothing else needs installing: the package bundles the .NET runtime, which is
why it weighs about fifty megabytes. Up to 0.2.0 it required ASP.NET Core 10
without checking that it was there, and on a machine without it the service
died at startup while the installer talked about insufficient privileges - a
cause that had nothing to do with the real one.

Note that this means the runtime's security fixes no longer come from
Windows Update. They come with a new Observer release.

If that machine already has an Observer service registered by hand, remove it
first, and empty the installation folder.

Linux

sudo apt install ./observer_0.24.4_amd64.deb

Requires Ubuntu 24.04 or later: aspnetcore-runtime-10.0 comes from the official
archive, so the runtime is not bundled and is updated with the system.

After installing

To watch the machine you are sitting at there is nothing to configure, and no token
is needed: the dashboard uses the local channel. The token and the certificate
fingerprint are needed only so that ANOTHER computer can query this one, and you get
them with observer share.