Backspace 1.0.5

Backspace 1.0.5

The desktop app stops offering a Restart button that cannot work, operators get
a real update script, and admins can see what version their instance runs
without reading the README.

What changed

The macOS update prompt told the truth for the first time

Every macOS launch showed "Update ready" with a Restart button that did nothing.
Dismissing it revealed a second card saying the update had failed, and the whole
sequence repeated on the next launch.

None of that was a glitch. Our macOS builds are ad-hoc signed, which means the
signature has no stable identity and macOS derives the app's identity from a hash
of that exact binary. The updater checks a new version against that hash before
installing it, and a new version never matches. It could not have worked for any
release, and it will not until the app carries a real Developer ID certificate.

The app now checks its own signature at startup and behaves accordingly. On a
build that cannot install its own updates it says so in plain words and offers a
download instead of a Restart button. It also stops downloading the release
archive it can never apply, which was costing 228 MB per machine, stored twice,
fetched again on every check, and it clears the copies already sitting there.

Dismissing the prompt now means something. It is remembered for that version, so
you see it once per release rather than once per launch, and it survives
switching instances. The update stays available in Settings, Desktop, so nothing
is lost by dismissing it.

Two smaller things fell out of the same work. A failed update no longer hides
behind the "ready" card that preceded it, and downloads show real progress on
Windows and Linux instead of a five second guess.

If you are on macOS, this release still has to be installed by hand. It is the
last one that will be silent about why.

./update.sh

There was no update script. The documented path was copying commands out of the
README.

./update.sh              Update, with one confirmation prompt
./update.sh --check      Report whether an update exists, changing nothing
./update.sh --yes        Update without prompting, for ssh and cron

It takes a database snapshot first, refreshes the checkout when that is possible
and says why when it is not, fetches the new image the way you installed
(pulling or rebuilding), and restarts only the Backspace container. Then it waits
for the healthcheck and checks that the running version actually changed. If the
new version does not come up, or comes up still running the old code, it puts the
previous image back.

An update with nothing to fetch skips the restart entirely, so nobody gets
dropped from a voice call for nothing.

It has been rehearsed on a live instance, including a deliberately broken update
that failed the health check and rolled back.

Instance Settings, Updates

Admins get a panel showing the running version, the commit, how the instance was
installed, whether a newer release exists, and the exact command for that
install.

The instance does not check for updates on a timer. The lookup happens only while
an admin has that panel open, so an instance whose admin never opens it never
contacts GitHub at all. BACKSPACE_UPDATE_CHECK=false turns it off outright for
airgapped deployments.

There is no button that performs the update, and that is deliberate. Applying a
container update from inside the container requires handing the container control
of the Docker daemon, which is root on the host. That is not a reasonable price
for saving one ssh.

Operator notes

Updating to this release. From your install directory:

git pull
docker compose pull backspace && docker compose up -d backspace

From 1.0.6 onward, ./update.sh does all of that for you. It ships in this
release, so you need this one before you can use it.

Name the service and do not pass --remove-orphans. If you run other
containers in the same compose project, Compose will suggest that flag, and
following it deletes them.

The compose file defaults to the latest image tag, so docker compose pull
moves you across releases, including ones carrying database migrations. Pin
BACKSPACE_IMAGE_TAG in your .env to stay on a specific version. Backups are
taken automatically before migrations run, and ./restore.sh restores them.

New environment variables, both optional and both documented in
.env.example: BACKSPACE_UPDATE_CHECK (default true) and
BACKSPACE_INSTALL_CHANNEL (written by install.sh).

Downloads

Platform	File
Windows (x64 + arm64)	Backspace-1.0.5.exe
macOS Apple Silicon	Backspace-1.0.5-arm64.dmg
macOS Intel	Backspace-1.0.5-x64.dmg
Linux x64	Backspace-1.0.5-x86_64.AppImage / Backspace-1.0.5-amd64.deb
Linux arm64	Backspace-1.0.5-arm64.AppImage / Backspace-1.0.5-arm64.deb

macOS first launch

The app is signed but not notarized, so Gatekeeper stops the first launch. You
only need to do this once.

macOS 15 and later: open the app, dismiss the warning, then go to System
Settings, Privacy & Security, and press Open Anyway.

macOS 14 and earlier: right-click the app, choose Open, then Open again.

Updating resets the Input Monitoring and Screen Recording permissions, because
the signature carries no stable identity. That is the same limitation behind the
update prompt described above.

Known, not fixed here

Auto-update on macOS still does not work, and cannot until the app is signed with
an Apple Developer ID. What changed is that the app no longer pretends otherwise.

./update.sh has been rehearsed on a prebuilt-image install. Its from-source
branch is written and checked but has not been run against real hardware.

Voice presence updates are still sent to the whole space, while the initial voice
state snapshot is correctly filtered by channel visibility. A member who cannot
see a voice channel gets a filtered list on connect and then sees that channel's
join and leave traffic.

Logging in directly at a remote instance still forwards your password to your
home instance. That path is what makes direct remote login work, so removing it
needs its own design. If you have connected to an instance you do not trust,
change your home password.