App updates for managed Macs

Every Mac app updates itself.
Just not when you need it to.

Barkeep runs in the background, works out how each app updates, and installs the update while the app is closed, once it's been out long enough to trust. Nobody gets interrupted unless a deadline you set says they must.

Download the latest release Read the admin guide

macOS 27+ · Apple silicon · Intune, Jamf, Kandji and other MDMs · Open source

Barkeep's window listing two updates waiting. Rectangle 2.0.4 is cooling off: it will be installed after 27 October, with a deadline of 3 November.

Reads the feed the app reads

Sparkle, Electron, VS Code and a built-in catalog. No scripts per app.

Trusts only the same developer

Same signing team, same app, newer version, notarised. Or nothing.

Waits for the app to close

Cooling-off first, then a quiet swap. Deadlines only when you set them.

Sources

Knows how apps update

Most apps already publish their updates somewhere. Barkeep reads the same feed they do.

Sparkle

The appcast in the app's SUFeedURL, with the EdDSA signature the app's own key expects. Channels, minimum macOS and delta-only items handled.

Electron and VS Code

electron-builder's latest-mac.yml (GitHub, generic or S3) with its SHA-512, and the Squirrel-style API in VS Code's product.json with its SHA-256.

A catalog, and yours

Chrome, Firefox, Zoom, Slack, Discord, Docker, ChatGPT, Claude, Tailscale, Obsidian, UTM and more are built in. Add anything else in the profile: a GitHub repository, an appcast, or any URL that says what's newest.

Knows its limits

App Store apps and apps with their own enterprise updater (Microsoft AutoUpdate, Adobe) are reported, not fought over. Apple's own apps are left to Software Update.

Barkeep's window listing four apps, each with the way it updates: Firefox from a JSON feed, Rectangle from Sparkle, Visual Studio Code from Squirrel, and Barkeep from its vendor. — Each app with the feed it updates from.

$ barkeep inspect "/Applications/Visual Studio Code.app"
Update source:  Squirrel (catalog) https://update.code.visualstudio.com
Newest:         1.143.1, released 21 Oct 2026 at 10:15
Checksums:      SHA-256
Update?:        yes

Security

No fake updates

A feed can be hijacked. A signature from the same developer can't be faked.

Same developer

Signed by the Apple-verified Team ID of the copy it replaces, and satisfying that copy's designated requirement: the rule macOS uses to decide two builds are the same app.

Same app, and newer

Same bundle ID, a higher version, built for this Mac's macOS and Apple silicon. No downgrades, however the feed is dressed up.

Same bytes the vendor signed

HTTPS only, size-limited, and matched against any checksum or Sparkle EdDSA signature in the feed. Gatekeeper has to agree it's notarised.

Checked where it's installed

Every check runs on a root-owned staged copy beside the app, which is then swapped in atomically. What's verified is exactly what gets installed.

Packages too

Updates shipped as .pkg must be signed by the app's own team and notarised, and the app they leave behind is checked again afterwards.

Locked configuration

Settings come from a managed profile users can't change. Root-owned files only.

Firefox's details in Barkeep: updated from 158.0 to 158.0.1, found in Barkeep's catalog, with the expected team 43AQ936H96 matching the installed app's Team ID. — An update is installed only if it's signed by the same developer team as the app it replaces.

Timing

Polite, until it can't be

The best time to update an app is when nobody is using it.

Cooling-off

An update waits until it has been out for a week (you choose), so the vendor's bad release is somebody else's Tuesday.
Quietly, while closed

The moment the app isn't running, it's swapped for the new version. Open it mid-swap and it reopens a moment later. The hold expires on its own, so a failed update never locks anyone out.
Deadline

Still open two weeks after release? A notification, an hour's grace, then the app is asked to quit, exactly as if they'd chosen Quit, so it can ask to save. It reopens when it's done.

Barkeep installing Firefox 158.0.1, with the date it was found, when it could install, and its deadline. — An update installing, with when it was found and its deadline.

Per-app rules. Exclude com.docker.docker, rush Chrome, never force Slack: every timing setting can be set per bundle ID.
Users can hurry it along. Update Now in Barkeep.app, if you allow it. The cooling-off period still applies.
Everywhere apps live. /Applications, every user's ~/Applications, one folder down, or the folders you choose.

The app

Nothing hidden from the people using the Mac

Barkeep.app sits in the menu bar and says what's waiting, and when.

Barkeep's menu bar popover: all 4 monitored apps are up to date. — Up to date

Barkeep's menu bar popover: 2 updates waiting, Firefox after 1 November and Rectangle after 27 October. — Updates waiting, and when they'll install

Barkeep's menu bar popover while Firefox installs and Barkeep checks for updates. — Installing

A dot when something's waiting, and an orange one when an app is about to be asked to quit.
A window with the reasons. Every app, how it updates, where its update stands and why. Standard users see their own apps and the shared ones; administrators see everyone's.
No privileges. The app only reads the daemon's state and sends it requests. Turn the icon off with ShowInMenuBar, or stop users starting updates with AllowUserInitiatedUpdates.

Deploy

Simple to run

One package, two profiles, no scripts per app.

Deploy the package

It installs /usr/local/bin/barkeep, the daemon that does the work, and Barkeep.app for the menu bar. Don't want the app? barkeep-cli.pkg leaves it out.
Deploy the profiles

The settings profile spells out every default, so it's safe unchanged, with examples for locked-down, fast-patching and never-interrupt setups. The App Management profile lets barkeep replace other developers' apps and pre-approves its notifications.
Watch it work

barkeep status, the log at /Library/Logs/barkeep.log, or Barkeep.app's window.

$ barkeep status
Firefox.app 150.0 → 158.0.1 [waitingForQuit] Firefox 158.0.1 will be installed when it quits, or by 31 Oct 2026 at 09:12
Slack.app 4.52.182 [upToDate] Slack.app 4.52.182 is up to date
Zoom.app 7.1.0 (60000) → 7.2.2.88465 [coolingOff] will be installed after 25 Oct 2026 at 14:00

Stable exit codes and --json everywhere, for scripts and reporting.
Barkeep keeps itself current. It installs its own releases once they're a week old and the Mac is idle, after checking their checksum, signing team and notarisation. Prefer your MDM? Turn it off in the profile.
Leaves when asked. sudo barkeep uninstall.

Know the limits

Barkeep updates apps that can be updated by replacing the app, or by the vendor's signed package. It doesn't sign in to the App Store for anyone, and can't update an app whose feed it can't find (tell it in the profile). At a deadline it asks apps to quit; only if you say so does it insist. The README covers the trade-offs in full.

Last orders for out-of-date apps.

Free and open source under the Apache License 2.0.