Skip to content

v1.7.25

Choose a tag to compare

View all tags
@marmutapp marmutapp released this 01 Jun 22:27
· 16 commits to main since this release
v1.7.25
283e362

Release headline. PyPI distribution alongside npm:
pip install superbased-observer (or uv tool install /
pipx install) now installs the same prebuilt observer binary
shipped on npm. Five platform-tagged wheels per release —
manylinux2014_{x86_64,aarch64}, macosx_*_{x86_64,arm64},
win_amd64 — published from the same v* tag-push that drives
the npm release. Versions are kept in lock-step.

Added (v1.7.25)

  • pypi/observer/ package source layout with hatchling-based
    build (pyproject.toml), thin Python launcher
    (observer/__main__.py) that os.execvs the bundled binary,
    and a per-platform wheel build flow mirroring the npm matrix.
  • publish-to-pypi job in .github/workflows/npm-release.yml:
    builds the 5 wheels and uploads via PYPI_TOKEN_OBSERVER +
    pypa/gh-action-pypi-publish. Runs in parallel with the npm
    publish job; gated to the private repo same as the rest.
  • pypi/observer/README.md long-description rendered on PyPI
    (mirrors npm README with pip-flavored install + troubleshooting
    sections).
  • Root README.md install section gains a pip / uv / pipx
    sub-section alongside the existing npm sub-section.
  • npm README.md adds a one-line cross-reference to the PyPI
    package so users see both options.
  • docs/pypi-package-plan-2026-06-02.md captures the full design
    doc (per-platform wheels vs sdist tradeoff, wheel-build
    mechanics, workflow integration, risks).

Compatibility (v1.7.25)

  • No schema migrations, no API changes, no behavior changes for
    existing users.
  • pip install and npm install -g produce byte-identical
    observer binaries — the wheel + tarball pull from the same
    CI artifact.

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform Asset
Linux x86_64 observer-v1.7.25-linux-x64.tar.gz
Linux arm64 observer-v1.7.25-linux-arm64.tar.gz
macOS x86_64 (Intel) observer-v1.7.25-darwin-x64.tar.gz
macOS arm64 (Apple Silicon) observer-v1.7.25-darwin-arm64.tar.gz
Windows x86_64 observer-v1.7.25-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.7.25

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.7.25-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.7.25

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.7.25 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private
Assets 16
Loading