NotallyXYZ 1.1.0

New

• Linux and Windows app (desktop/): the same notes, lists, labels, colors, reminders and attachments as the Android and macOS apps, with end-to-end encrypted sync.
  • Windows 10 and 11 x64: NotallyXYZ-windows-x64-1.1.0.exe, a portable app with no installer. It needs WebView2 and has no code signature, so SmartScreen asks once: More info → Run anyway.
  • Debian and Ubuntu 22.04 or later: sudo apt install ./notallyxyz_1.1.0_amd64.deb (or _arm64.deb).
  • Other distributions: NotallyXYZ-linux-<arch>-1.1.0.tar.gz. It needs GTK 3 and WebKitGTK 4.1.
• Appearance settings on macOS and the desktop app: theme, text size, grid or list, note preview on or off, lines and items in the preview, and labels, images and dates on cards. Android already had these settings.

Security fix: sealed deletions

In 1.0.0 a deletion had no sealed data. The server, or anyone with the access token (for example a proxy that ends TLS), could therefore make all devices delete their notes. In 1.1.0 every deletion carries a sealed tombstone, and the apps apply a deletion only if it opens with the sync key. A change that does not open is ignored, and the device writes its copy to the server again. Details: server/PROTOCOL.md §5–7.

Update the server and all apps together. 1.0.0 apps cannot sync deletions with a 1.1.0 server. A note that a 1.0.0 app deleted, and that a device did not sync before the update, can come back once. No data is lost.

Files

• Android: NotallyXYZ-android-1.1.0.apk (same signing key as 1.0.0)
• macOS 26+: NotallyXYZ-macos-1.1.0.dmg
• Linux and Windows: built by GitHub Actions and attached a few minutes after the release
• Server: ghcr.io/turtlecute33/notallyxyz-server:1.1 (also :1)

Check: sha256sum -c SHA256SUMS --ignore-missing. Desktop files: gh attestation verify <file> -R Turtlecute33/NotallyXYZ.