Backspace 1.0.1
Backspace 1.0.1
Fixes the macOS app refusing to open, and hardens the desktop builds.
The macOS fix
Backspace 1.0.0 did not open on macOS. It reported:
"Backspace.app" is damaged and can't be opened. You should move it to the Trash.
The bundle was not simply unsigned. It carried a signature that no longer matched its own contents, because packaging renames the executable, rewrites Info.plist and injects the app code after the prebuilt Electron binaries were signed, and nothing sealed it again afterwards. macOS treats an invalid signature as damage and gives you no way past it in the interface, which is why the usual right-click and Open trick did nothing.
macOS builds are now sealed during packaging, and the release job checks the signature and fails the build if it is not valid. Thanks to @cccccccccccccccccnrd for the report (#38).
Opening it the first time
The app is not notarized, so Gatekeeper still stops the first launch. You only need to do this once.
macOS 15 and later: open the app, dismiss the warning, then go to System Settings, Privacy & Security, and press Open Anyway.
macOS 14 and earlier: right-click the app, choose Open, then Open again.
Desktop hardening
Every packaged build now has three Electron fuses set: RunAsNode off, EnableNodeCliInspectArguments off, and OnlyLoadAppFromAsar on. The main process also refuses top-level navigation to origins it does not recognise.
The release job reads the fuses back out of each packaged binary on all six platform and architecture combinations, and fails if any of them is not what it should be.
Downloads
| Platform | File |
|---|---|
| Windows (x64 + arm64) | Backspace-1.0.1.exe |
| macOS Apple Silicon | Backspace-1.0.1-arm64.dmg |
| macOS Intel | Backspace-1.0.1-x64.dmg |
| Linux x64 | Backspace-1.0.1-x86_64.AppImage / Backspace-1.0.1-amd64.deb |
| Linux arm64 | Backspace-1.0.1-arm64.AppImage / Backspace-1.0.1-arm64.deb |
Server
No server changes in this release, and no 1.0.1 container image was published.
The image build failed on this tag. better-sqlite3 stopped shipping a Node 20 prebuild from version 12.10.0 onwards, so it tried to compile from source inside node:20-slim, which has no compiler. That has been broken since the dependency was upgraded on 2026-08-25, and went unnoticed because the image only builds on a version tag and none was cut in between.
The fix is on main and the image will publish correctly on the next release. Self-hosters are unaffected: ghcr.io/thezwiss/backspace:latest still points at the last good image, and there are no server changes here to miss.
Still true on macOS
Auto-update does not work. The signature has no developer identity for the updater to check against, so watch the releases page for new versions.
For the same reason macOS may ask again for Input Monitoring and Screen Recording permission after an update, which affects global keybinds and screen sharing.
Windows and Linux AppImage builds auto-update as before.
