Skip to content

v1.8.1

Choose a tag to compare

View all tags
@marmutapp marmutapp released this 03 Jun 07:32
· 20 commits to main since this release
v1.8.1
d4449ea

Release headline. Hotfix for the v1.8.0 release run: lint cleanup +
fixes the VS Code Marketplace publish that failed with "v1.7.28
already exists" because the VSIX manifest version wasn't being
stamped in lockstep with the release tag. No Go behaviour changes —
the agent + org-server interop story from v1.8.0 stands.

Fixed

  • VS Code Marketplace + Open VSX publish now build VSIXes with the
    correct release-tag version. scripts/sync-npm-version.sh stamps
    vscode/package.json alongside the six npm packages, and the
    vscode-package CI job invokes it before vsce package (the
    npm-publish stamp runs in parallel, too late for the VSIX build).
  • internal/store/orgpush.go::SelectUnpushedSince carried a
    //nolint:gocyclo annotation explaining why the four sequential
    per-table loops keep the function long-but-regular.
  • Four call sites in internal/db/db.go, internal/orgserver/server.go,
    and cmd/observer-org/scrub.go carry //nolint:gosec annotations
    on fmt.Sprintf SQL fragments whose table/column args come from
    in-package allowlists (gosec G201 is a false positive for those).
  • cmd/observer/org.go enrol-followup if/else chain rewritten as a
    switch (gocritic).
  • Stale scrubConfigDefaultPath package var removed from
    cmd/observer-org/scrub.go.

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform Asset
Linux x86_64 observer-v1.8.1-linux-x64.tar.gz
Linux arm64 observer-v1.8.1-linux-arm64.tar.gz
macOS x86_64 (Intel) observer-v1.8.1-darwin-x64.tar.gz
macOS arm64 (Apple Silicon) observer-v1.8.1-darwin-arm64.tar.gz
Windows x86_64 observer-v1.8.1-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.8.1

Org server (Docker)

The self-hosted org server ships as a Docker image and as per-platform observer-org-v1.8.1-* archives (attached below).

docker pull ghcr.io/marmutapp/observer-org:v1.8.1

The image is keyless-signed with cosign. Verify it:

cosign verify ghcr.io/marmutapp/observer-org:v1.8.1 \
  --certificate-identity-regexp 'https://github.com/marmutapp/superbased-observer-private/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Supply chain

CycloneDX SBOMs are attached: observer.cdx.json and observer-org.cdx.json.

SLSA Level 3 build provenance for the binaries is attached below as a *.intoto.jsonl attestation. The build runs on the private origin repo, so pass that as the source when verifying an extracted binary with slsa-verifier v2.7.0 or newer (older versions fail with unexpected tlog entry type: expected intoto:0.0.2, got dsse:0.0.1):

slsa-verifier verify-artifact ./observer \
  --provenance-path *.intoto.jsonl \
  --source-uri github.com/marmutapp/superbased-observer-private
Assets 16
Loading