In-app updates via AppUpdater

[trsdn]

Goal

Ptions+ should update itself from GitHub Releases.

Specific to this repository

• Broker profile: ptionsplus (Xcode). The artifacts today are Ptions+.dmg / Ptions+.zip, with no version.
  • AppUpdater needs PtionsPlus-<semver>.dmg (the repository name), so add PtionsPlus-{version}.dmg as a copy_of Ptions+.dmg.
  • The mounted DMG must contain exactly one app with the installed app's file name (Ptions+.app). Check that AppUpdater handles the + in the bundle name.
• Accessibility / Input Monitoring: these grants are tied to the code signature. Keep the Developer ID signature stable across updates.
• Before installing, release the event tap so button remapping doesn't die mid-swap.
• Xcode build: declare AppUpdater_AppUpdater.bundle, and add a broker lock with -onlyUsePackageVersionsFromResolvedFile (see feat: AppUpdater support for openlens, with release publishing macos-notarization-broker#43).
• release.yml: it must not upload a DMG under the updater's name.

Reference implementation

This is the same setup as OpenLens, OpenDefendrWatchr, OpenZombr and OpenConnct, all released on 2026-09-16:

• The app:
  • An UpdateManager wraps mxcl/AppUpdater 4.1.2, pinned with exact: and with Package.resolved committed. See trsdn/OpenLens Sources/OpenLens/Update/UpdateManager.swift or trsdn/OpenDefendrWatchr Sources/OpenDefendrWatchr/Update/UpdateManager.swift.
  • It checks once a day (waking hourly), downloads and validates the update in the background, and offers Install and Restart.
  • The menu has Check for Updates… and a Check for Updates Automatically toggle, which is on by default.
  • The app stops its own work cleanly before the bundle is swapped.
• No GitHubAttestationPolicy:
  • Broker releases are built in another repository.
  • For swift build products, AppUpdater's Bundle.module lookup never looks in Contents/Resources, so verifying an attestation ends in fatalError (In-app update verification will reject tag-triggered releases (attested ref is refs/tags/…, policy expects refs/heads/main) OpenWritr#31).
  • The Developer ID, Team ID and bundle ID checks still apply.
• Release asset: AppUpdater only accepts an asset named exactly <repository>-<semver>.dmg, containing one app with the installed app's file name. On the broker, add it as a copy_of the notarized DMG (feat: AppUpdater support for openlens, with release publishing macos-notarization-broker#43). scripts/request.sh <profile> vX.Y.Z --publish then uploads it.
• Broker profile:
  • Add a dependency_lock equal to the app's Package.resolved.
  • If the build embeds AppUpdater_AppUpdater.bundle, list it under nested_resource_bundles (examples: feat: AppUpdater releases for opendefendrwatchr, onboard openzombr macos-notarization-broker#46 for SwiftPM apps, feat(openconnct): pin AppUpdater and publish the updater DMG macos-notarization-broker#48 for a Makefile build).
• Existing installs have no updater, so users install the first release that has one manually.

To do

• Add AppUpdater 4.1.2 (exact version) and commit Package.resolved.
• Add an UpdateManager and menu items, and stop the app's work before installing.
• Broker: add the dependency lock, the resource bundle declaration if needed, and the PtionsPlus-{version}.dmg copy_of artifact.
• Release with scripts/request.sh ptionsplus vX.Y.Z --publish.
• After two releases, test a real update on a Mac other than the build machine.

🤖 Generated with Claude Code