Skip to content

v1.7.2

Choose a tag to compare

View all tags
@marmutapp marmutapp released this 27 May 13:36
· 16 commits to main since this release
v1.7.2
0684d4b

fix(release): stage the provenance file, not its artifact directory

The v1.7.1 fix generated SLSA provenance correctly, but the public_release
staging step failed (cp: -r not specified; omitting directory):
download-artifact extracts each artifact into a directory named after it
(artifacts/multiple.intoto.jsonl/) with the real file inside, and the
find … -name '*.intoto.jsonl' matched the directory first. Added -type f so
it selects the file. v1.7.1's public_release job failed before creating the
release, so there is no public v1.7.1 GitHub Release — v1.7.2 is the first
complete public release of the v1.7 line (Teams M0–M5 + cache fix + docs) with
SLSA L3 provenance attached. No product code changes.

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform Asset
Linux x86_64 observer-v1.7.2-linux-x64.tar.gz
Linux arm64 observer-v1.7.2-linux-arm64.tar.gz
macOS x86_64 (Intel) observer-v1.7.2-darwin-x64.tar.gz
macOS arm64 (Apple Silicon) observer-v1.7.2-darwin-arm64.tar.gz
Windows x86_64 observer-v1.7.2-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.7.2

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.7.2-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.7.2

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.7.2 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier:

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private
Assets 16
Loading