Skip to content

v1.37.1

Latest
Latest

Choose a tag to compare

View all tags
@marmutapp marmutapp released this 01 Nov 12:41
v1.37.1
98eb8f1

Patch release on the stable channel. The program is the same as 1.37.0; this release exists
because the 1.37.0 public GitHub release has no binaries.

Fixed

  • The release builds the Windows setup program again. The 1.37.0 release job could not build
    superbased-observer-setup-1.37.0-win32-x64.exe (its script used Windows path separators, which
    the Linux build host cannot read), and the public GitHub release depends on it, so 1.37.0 has no
    public binaries: install.sh, install.ps1 and the download page stayed on 1.36.0. 1.37.1 ships
    them, with the setup program. npm, PyPI, the VS Code Marketplace and Open VSX did get 1.37.0;
    moving from 1.37.0 to 1.37.1 changes no behaviour.

Downloads

Every version, with the file to pick for your computer and how to check it: https://superbased.app/download

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform Asset
Windows x86_64 (setup program, per user, no admin) superbased-observer-setup-v1.37.1-win32-x64.exe
Linux x86_64 observer-v1.37.1-linux-x64.tar.gz
Linux arm64 observer-v1.37.1-linux-arm64.tar.gz
macOS x86_64 (Intel) observer-v1.37.1-darwin-x64.tar.gz
macOS arm64 (Apple Silicon) observer-v1.37.1-darwin-arm64.tar.gz
Windows x86_64 observer-v1.37.1-win32-x64.zip

Verify with sha256sum -c --ignore-missing SHA256SUMS (or shasum -a 256 -c --ignore-missing SHA256SUMS on macOS) from the directory containing the downloads. SHA256SUMS.sig is a vendor Ed25519 signature over that list; the public key and the one-line openssl check are on https://superbased.app/download.

The Windows setup program installs the developer edition for your user account (no admin prompt), can add it to your Path and start it at sign-in, and registers an uninstaller in Apps and Features. It is not code-signed yet, so Windows SmartScreen may ask you to confirm (More info, then Run anyway).

Editions and the installer

The archives above are the full edition. The minimal, developer and managed editions ship for the same five platforms as observer-v1.37.1-<edition>-<platform>.tar.gz (.zip on Windows). The installer picks the edition and platform, checks the archive against SHA256SUMS and its vendor signature, and installs it:

curl -fsSLO https://github.com/superbasedapp/observer/releases/download/v1.37.1/install.sh
sh install.sh --version v1.37.1 --edition developer

On Windows: download install.ps1 and run powershell -ExecutionPolicy Bypass -File install.ps1 -Version v1.37.1 -Edition developer. Both installers take --from-dir / -FromDir for an air-gapped install from these files.

Also available via npm: npm install -g @superbased/observer@1.37.1

Org server (Teams)

The self-hosted org server is an enterprise-licensed product distributed from SuperBased's private container registry with a per-customer pull token issued with your enterprise licence; its release assets are not attached here. Contact sales for a pull token. The pull-and-verify recipe for your exact release is the README.md of the deployment bundle (observer-org deploy export).

Enterprise updates

This release publishes on the stable channel.

Each agent archive carries a detached vendor signature (<archive>.sig, raw Ed25519 over the archive bytes) and the release ships a signed update-manifest-stable.json. Self-hosted org servers consume them with:

observer-org update sync --version v1.37.1
observer-org update publish --channel stable --version v1.37.1

For a disconnected server, download observer-v1.37.1-airgap-bundle.tar (archives + signatures + SHA256SUMS + the signed manifest + provenance), carry it across the gap, and run observer-org update import --version v1.37.1 --bundle <dir>.

Supply chain

A CycloneDX SBOM for the agent is attached: observer.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private
Assets 54
Loading