Skip to content
Logo

Updates

Boo uses Sparkle for signed macOS updates.

How Checks Work

  • Sparkle manages background update checks after it has been initialized by the app.
  • You can trigger a manual check from Boo → Check for Updates...
  • Update metadata is published at https://ph1p.github.io/boo/updates/appcast.xml
  • Release archives are downloaded from GitHub Releases
  • Local make run builds have Sparkle disabled because the debug bundle removes SUFeedURL and SUPublicEDKey

Install Flow

When an update is installed, Boo:

  1. Fetches the Sparkle appcast feed.
  2. Downloads the signed release archive for the selected update.
  3. Verifies the Sparkle EdDSA signature and Apple code signature.
  4. Installs the updated app and relaunches.

Appcast XML is hosted on GitHub Pages, while release archives remain on GitHub Releases.

Release Pipeline

Releases are automated with semantic-release. Conventional commits on main determine the version bump, then CI builds, signs, notarizes, publishes the release artifacts, and updates the Sparkle appcast deployed via GitHub Pages.

The appcast is generated during release preparation from the newly built ZIP archive. It is then injected into the GitHub Pages site during the release Pages deploy, rather than being committed to the repository. Ordinary documentation deploys fetch the currently published appcast first so /updates/appcast.xml stays stable across docs-only changes.

Release packaging uses the already-built Boo.app bundle for the ZIP archive instead of rebuilding the app after signing. This keeps Sparkle's bundled framework and helper tools in the exact signed/notarized state that was validated earlier in the pipeline.