Skip to content

v1.7.26

Choose a tag to compare

View all tags
@marmutapp marmutapp released this 01 Jun 23:52
· 16 commits to main since this release
v1.7.26
84bdc13

Release headline. Hotfix for v1.7.25: the PyPI wheels
uploaded in v1.7.25 were 24 KB and did NOT contain the observer
binary. Root cause: hatchling's default file-collection respects
.gitignore, and pypi/observer/.gitignore listed
src/observer/_bin/observer (intentionally — to keep staged
binaries out of git). The interaction silently dropped the
binary from the wheel. v1.7.25 has been yanked from PyPI.

Fixed (v1.7.26)

  • pypi/observer/pyproject.toml — explicitly excludes
    src/observer/_bin from the [tool.hatch.build.targets.wheel] packages glob and pulls the binary back in via
    [tool.hatch.build.targets.wheel.force-include], which
    bypasses gitignore filtering. Wheels now contain the binary
    again (~21 MB compressed, was 24 KB).
  • CI guard in publish-to-pypi: after retagging each wheel,
    unzip-inspect to verify _bin/observer{,.exe} is present and

    1 MB. Fails the workflow loudly instead of shipping empty
    wheels.

Compatibility (v1.7.26)

  • No behavior changes for npm users (npm v1.7.25 was fully
    functional; the bug was PyPI-only).
  • PyPI users on v1.7.25 should upgrade to v1.7.26:
    pip install --upgrade superbased-observer.

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform Asset
Linux x86_64 observer-v1.7.26-linux-x64.tar.gz
Linux arm64 observer-v1.7.26-linux-arm64.tar.gz
macOS x86_64 (Intel) observer-v1.7.26-darwin-x64.tar.gz
macOS arm64 (Apple Silicon) observer-v1.7.26-darwin-arm64.tar.gz
Windows x86_64 observer-v1.7.26-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.7.26

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.7.26-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.7.26

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.7.26 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private
Assets 16
Loading