✓Direct Answer

Oyma checks for updates over encrypted HTTPS using cryptographic Apple Developer ID signatures. You maintain full control over whether updates install automatically or require manual review.

Secure Software Distribution on macOS

Software updates are a critical security surface. Malicious actors frequently attempt to hijack update channels to push unauthorized binaries, while poorly designed update mechanisms disrupt active user workflows without warning.

Oyma implements an enterprise-grade update pipeline built on transparent, cryptographically verifiable distribution standards.

Cryptographic Verification with Apple Developer ID

Every release of Oyma is signed with an official Apple Developer ID and protected through Apple’s security architecture:

  • Code Signing: The binary contains an immutable cryptographic signature (Developer ID Application: ...). Any tampering or unauthorized modification of the executable causes macOS Gatekeeper to immediately block execution.
  • Hardened Runtime Enforcement: macOS validates that the software enforces runtime integrity, executes without unsafe memory permissions, and restricts third-party code injection.

You can verify the signature of Oyma directly from Terminal:

# Check code signature and team validity
codesign -dv --verbose=4 /Applications/Oyma.app

# Verify Apple Gatekeeper assessment
spctl --assess --type execute --verbose /Applications/Oyma.app

User-Controlled Update Settings

In Preferences > General > Updates, you have full control over update behavior:

  1. Check for Updates Automatically: Periodically checks an HTTPS feed for new version metadata.
  2. Manual Updates Only: Disables background update checks completely for air-gapped or high-compliance environments.
  3. Release Notes Preview: Review comprehensive changelogs, bug fixes, and new features before agreeing to download any update.

Secure In-App Updates with Cryptographic Verification

To keep your application secure while respecting operator autonomy, Oyma uses a secure update pipeline backed by Ed25519 public-key signature verification:

  1. Manifest Integrity: Every update manifest contains SHA-256 hashes and Ed25519 cryptographic signatures generated on offline developer machines.
  2. Apple Developer ID Validation: Before installing an update, macOS verifies that the new binary is signed with our valid Apple Developer ID and verified by Gatekeeper.
  3. Zero Automated Overwrites: Oyma never overwrites the active binary while you are recording or editing notes. Updates apply cleanly upon restart after your explicit confirmation.
  4. Offline and Air-Gapped Deployments: Organizations with strict change-control policies can disable in-app update checks entirely and distribute .dmg releases via internal software catalogs.

Reproducible Releases and Checksum Auditing

Every update package published by Oyma includes an official SHA-256 checksum posted on our public release notes. Enterprise security teams can verify the downloaded disk image against the published hash prior to deployment, ensuring that no man-in-the-middle tampering has occurred.

In mission-critical workstations where operating systems are strictly locked down, administrators can disable Sparkle automated checking entirely by setting a standard macOS preference domain key (defaults write com.Oyma.mac AutoCheckUpdates -bool false), guaranteeing that no unexpected network checks or background popups occur during high-stakes presentations.

Related Questions & Architecture Guides