In-app updates via AppUpdater

[trsdn]

Goal

OpenSwitchr should update itself from GitHub Releases.

Specific to this repository

• Broker profile: openswitchr (SwiftPM) already exists with ZIP and DMG artifacts, but there is no GitHub release yet.
  • Add OpenSwitchr-{version}.dmg as a copy_of the DMG.
  • Add a dependency_lock, and copy and declare AppUpdater_AppUpdater.bundle, like assemble_menu_bar_swiftpm in feat: AppUpdater releases for opendefendrwatchr, onboard openzombr macos-notarization-broker#46.
• Accessibility / Screen Recording: these grants are tied to the code signature. Keep the signature stable across updates.
• Before installing, tear down the Dock hover observer and the switcher window.

Reference implementation

This is the same setup as OpenLens, OpenDefendrWatchr, OpenZombr and OpenConnct, all released on 2026-09-16:

• The app:
  • An UpdateManager wraps mxcl/AppUpdater 4.1.2, pinned with exact: and with Package.resolved committed. See trsdn/OpenLens Sources/OpenLens/Update/UpdateManager.swift or trsdn/OpenDefendrWatchr Sources/OpenDefendrWatchr/Update/UpdateManager.swift.
  • It checks once a day (waking hourly), downloads and validates the update in the background, and offers Install and Restart.
  • The menu has Check for Updates… and a Check for Updates Automatically toggle, which is on by default.
  • The app stops its own work cleanly before the bundle is swapped.
• No GitHubAttestationPolicy:
  • Broker releases are built in another repository.
  • For swift build products, AppUpdater's Bundle.module lookup never looks in Contents/Resources, so verifying an attestation ends in fatalError (In-app update verification will reject tag-triggered releases (attested ref is refs/tags/…, policy expects refs/heads/main) OpenWritr#31).
  • The Developer ID, Team ID and bundle ID checks still apply.
• Release asset: AppUpdater only accepts an asset named exactly <repository>-<semver>.dmg, containing one app with the installed app's file name. On the broker, add it as a copy_of the notarized DMG (feat: AppUpdater support for openlens, with release publishing macos-notarization-broker#43). scripts/request.sh <profile> vX.Y.Z --publish then uploads it.
• Broker profile:
  • Add a dependency_lock equal to the app's Package.resolved.
  • If the build embeds AppUpdater_AppUpdater.bundle, list it under nested_resource_bundles (examples: feat: AppUpdater releases for opendefendrwatchr, onboard openzombr macos-notarization-broker#46 for SwiftPM apps, feat(openconnct): pin AppUpdater and publish the updater DMG macos-notarization-broker#48 for a Makefile build).
• Existing installs have no updater, so users install the first release that has one manually.

To do

• Add AppUpdater 4.1.2 (exact version) and commit Package.resolved.
• Add an UpdateManager and menu items, and stop the app's work before installing.
• Broker: add the dependency lock, the resource bundle declaration if needed, and the OpenSwitchr-{version}.dmg copy_of artifact.
• Release with scripts/request.sh openswitchr vX.Y.Z --publish.
• After two releases, test a real update on a Mac other than the build machine.

🤖 Generated with Claude Code

[trsdn]

Status after #54 and #55. Left open on purpose: what this repository can do is done, and the rest is outside it.

Done (in main):

• AppUpdater 4.1.2 pinned exact:, Package.resolved committed; Dependabot now watches the Swift package (build: Dependabot watches the Swift package (follow-up to #54) #55).
• UpdateManager with the daily check (wakes hourly), background download + validation, Install and Restart, Check for Updates… in the menu, a Check for Updates Automatically toggle (on by default), and the app stops its event tap, Dock observer, scroll tap and panels before the bundle is replaced.
• Pure, unit-tested schedule and state rules; no GitHubAttestationPolicy, for the reasons in the issue.
• THIRD_PARTY_NOTICES.txt (AppUpdater Unlicense, Version Apache-2.0) in the bundle via build-app.sh.
• The README Privacy section, project page, Settings and AGENTS.md now say the app makes one network connection (this one) instead of none.

Not done, and not doable from this repository (all in RELEASE_CHECKLIST.md, "Updates and the broker"):

• Broker: emit an exact OpenSwitchr-{version}.dmg asset (copy_of the notarized DMG), add the dependency_lock, declare AppUpdater_AppUpdater.bundle under nested_resource_bundles, and copy THIRD_PARTY_NOTICES.txt.
• Release with `scripts/request.sh openswitchr vX.Y.Z --publish`. I did not publish a release: `AGENTS.md` says to ask first, and it needs the broker step above.
• After two releases, test a real update on a Mac other than the build machine. A real update has never been run.

Until the broker work lands and a release exists, the updater finds nothing to install.

[trsdn]

Status after trsdn/macos-notarization-broker#56 (merged) and the docs follow-up. Left open, for three reasons no change to code can resolve.

Now done:

• AppUpdater 4.1.2 pinned exact: with Package.resolved committed; Dependabot watches it.
• UpdateManager, menu items, the Check for Updates Automatically toggle, and the app stops its event tap, Dock observer, scroll tap and panels before install.
• Broker: dependency_lock (locks/openswitchr-Package.resolved), the AppUpdater_AppUpdater.bundle declaration, and the exact OpenSwitchr-{version}.dmg copy_of artifact all landed. I ran the real adapter against this repo with a real build; the tree passes the broker's preflight. THIRD_PARTY_NOTICES.txt is bundled.

Still open:

• Release with scripts/request.sh openswitchr vX.Y.Z --publish. I did not, on purpose: the broker's AGENTS.md says publishing a release needs an explicit ask, and the signing job runs in a protected environment that needs a human approval I can't give. v0.1.0 is 26 commits behind main, so it can't be the one: the first updater-capable release needs a new version (changelog section, Info.plist bump, tag).
• After two releases, test a real update on a Mac other than the build machine. A real update has never been run anywhere.
• Keep the signature stable across updates (Accessibility/Screen Recording grants are tied to it): a property of how the broker signs, only observable across two real releases.

Say the word on a version number and I'll prepare the release PR (changelog, Info.plist, tag proposal), and you drive the broker step.

[trsdn]

Release preparation is up as a draft PR (#59): changelog section and Info.plist for 0.2.0, checks green. It is not merged and nothing is tagged. What remains is yours: the tag, scripts/request.sh openswitchr v0.2.0 --publish (the signing job needs your approval in the broker's protected environment), and later a real update test, which needs a second release installed over the first on another Mac.

[trsdn]

Released v0.2.0 and v0.2.1 (both Developer ID signed, notarized, stapled; verified by mounting the DMGs). Two releases now exist, so the real update test is possible: install 0.2.0 (OpenSwitchr-0.2.0.dmg), run it, use Check for Updates, and confirm it installs 0.2.1 and that Accessibility/Screen Recording permissions survive (same signature). Still open until that has been run on a real Mac.

[trsdn]

Verified from the published releases (not just the build): 0.2.0 and 0.2.1 have the same bundle id, TeamIdentifier G69Z5BNY97 and identical designated requirement, so TCC permissions should survive an update; releases/latest is v0.2.1 and carries OpenSwitchr-0.2.1.dmg, the exact asset name AppUpdater looks for. Remaining: run the in-app update once (0.2.0 → 0.2.1) on a real Mac.

[trsdn]

End-to-end update test run on a real Mac (macOS, this session): v0.2.0 (from the published DMG) → Check for Updates… found and downloaded 0.2.1 → Install Update 0.2.1 and Restart replaced the bundle and relaunched as 0.2.1; codesign --verify --deep --strict OK, TeamIdentifier G69Z5BNY97 unchanged, so TCC permissions carry over. One thing learned: AppUpdater refuses a bundle whose path contains a symlink (/tmp → /private/tmp, error "installation staging location is writable or unsafe"); from a normal folder it works. Releases v0.2.0 and v0.2.1 are published, Developer ID signed, notarized, stapled.