In-app updates via AppUpdater

[trsdn]

Goal

md2loop should update itself from GitHub Releases.

Specific to this repository

• Broker profile: md2loop (Xcode, already uses a broker dependency_lock). The DMG is md2loop-{version}-macos.dmg.
  • Add md2loop-{version}.dmg as a copy_of it.
  • The DMG must contain one app named like the installed one.
• Lock: add AppUpdater to the Xcode project (project.yml) and update the broker's locks/md2loop-Package.resolved in the same broker PR, because the adapter overwrites the workspace lock with it.
• Resource bundle: declare AppUpdater_AppUpdater.bundle under nested_resource_bundles, because Xcode embeds it.
• release.yml: it signs releases itself. Make sure it doesn't also publish a DMG under the updater's name, which would race the broker.

Reference implementation

This is the same setup as OpenLens, OpenDefendrWatchr, OpenZombr and OpenConnct, all released on 2026-09-16:

• The app:
  • An UpdateManager wraps mxcl/AppUpdater 4.1.2, pinned with exact: and with Package.resolved committed. See trsdn/OpenLens Sources/OpenLens/Update/UpdateManager.swift or trsdn/OpenDefendrWatchr Sources/OpenDefendrWatchr/Update/UpdateManager.swift.
  • It checks once a day (waking hourly), downloads and validates the update in the background, and offers Install and Restart.
  • The menu has Check for Updates… and a Check for Updates Automatically toggle, which is on by default.
  • The app stops its own work cleanly before the bundle is swapped.
• No GitHubAttestationPolicy:
  • Broker releases are built in another repository.
  • For swift build products, AppUpdater's Bundle.module lookup never looks in Contents/Resources, so verifying an attestation ends in fatalError (In-app update verification will reject tag-triggered releases (attested ref is refs/tags/…, policy expects refs/heads/main) OpenWritr#31).
  • The Developer ID, Team ID and bundle ID checks still apply.
• Release asset: AppUpdater only accepts an asset named exactly <repository>-<semver>.dmg, containing one app with the installed app's file name. On the broker, add it as a copy_of the notarized DMG (feat: AppUpdater support for openlens, with release publishing macos-notarization-broker#43). scripts/request.sh <profile> vX.Y.Z --publish then uploads it.
• Broker profile:
  • Add a dependency_lock equal to the app's Package.resolved.
  • If the build embeds AppUpdater_AppUpdater.bundle, list it under nested_resource_bundles (examples: feat: AppUpdater releases for opendefendrwatchr, onboard openzombr macos-notarization-broker#46 for SwiftPM apps, feat(openconnct): pin AppUpdater and publish the updater DMG macos-notarization-broker#48 for a Makefile build).
• Existing installs have no updater, so users install the first release that has one manually.

To do

• Add AppUpdater 4.1.2 (exact version) and commit Package.resolved.
• Add an UpdateManager and menu items, and stop the app's work before installing.
• Broker: add the dependency lock, the resource bundle declaration if needed, and the md2loop-{version}.dmg copy_of artifact.
• Release with scripts/request.sh md2loop vX.Y.Z --publish.
• After two releases, test a real update on a Mac other than the build machine.

🤖 Generated with Claude Code