Updating
MacGet updates itself through Sparkle, verifying an EdDSA signature on every update before it installs.
After the first install you don't come back to the website. MacGet keeps itself current with Sparkle, the standard auto-update framework for Mac apps distributed outside the App Store.
How it works
On launch, MacGet quietly checks a signed appcast feed on a schedule. When a newer version is published, it offers to download and install it.
You can also check whenever you like: MacGet → Check for Updates… in the menu bar.
Why updates are trustworthy on an un-notarized build
Every release is signed with an EdDSA private key held by the maintainer.
MacGet ships with the corresponding public key (SUPublicEDKey in its
Info.plist) and verifies the signature of any update before installing it.
An update that was tampered with, corrupted in transit, or served by someone who compromised the feed host fails that check and is rejected. This is independent of Apple notarization, which is why auto-updates remain safe even though the build is not notarized.
Updates install without repeating the Gatekeeper step — macOS already trusts the app.
Building from source
If you build from source without adding the Sparkle package dependency, the
updater is compiled out entirely (#if canImport(Sparkle)) and Check for
Updates… explains that the dependency is missing. Pull and rebuild to update
in that case.
For maintainers
Publishing an update:
- Bump Marketing Version and Current Project Version in the Xcode target settings.
- Add an entry to
CHANGELOG.md— the site's changelog page is generated from it. - Run
./scripts/release.shfrom the repository root. - Create a GitHub release with the produced
dist/*.dmgattached. - Regenerate the signed feed with
Sparkle/bin/generate_appcast site/and pushsite/.
The signing key is unrecoverable
The EdDSA private key lives only in the maintainer's login Keychain, as "Private key for signing Sparkle updates". Without a backup you can never sign another update that existing installs will accept. Back it up offline.
First Launch & Gatekeeper
MacGet is distributed un-notarized, so macOS blocks the first launch. What the warning means and how to clear it, once.
Adding Downloads
Five ways to get a URL into MacGet's queue — the Add sheet, drag and drop, the clipboard watcher, macOS Services, and the macget:// URL scheme.