macOS

macOS ships as a DMG. It contains DeutschlandGPT.app as a universal binary for Apple silicon and Intel, signed with a Developer ID certificate and notarised by Apple.

Both URLs are stable and always point at the newest build, so a label or a script never needs adjusting for a release.

Installomator

If you use Installomator, for example through a Jamf Pro policy, this is the shortest path. The label below installs the app and updates an existing installation in place:

deutschlandgpt)
    name="DeutschlandGPT"
    type="dmg"
    downloadURL="https://www.deutschlandgpt.de/api/desktop/download/darwin"
    appNewVersion=$(curl -fsL "https://www.deutschlandgpt.de/api/desktop/version/darwin")
    expectedTeamID="XT228V86UU"
    blockingProcesses=( "DeutschlandGPT" )
    ;;

Drop the label into its own fragment file on the managed Mac, recent Installomator versions read /Library/Application Support/Installomator/*.sh for that, or add it to your Installomator fork. Then call it like any other label:

/usr/local/Installomator/Installomator.sh deutschlandgpt \
    BLOCKING_PROCESS_ACTION=tell_user NOTIFY=success

expectedTeamID is the important part: Installomator aborts if the downloaded app is not signed with our certificate, so a tampered or wrong file never gets installed.

Because the app installs to /Applications/DeutschlandGPT.app, exactly where a manual install from the DMG lands, Installomator adopts an existing installation instead of creating a second copy.

Without Installomator

Without Installomator the flow is the same as for any other DMG: mount it, copy the app into /Applications, detach. A script an MDM can run as a policy looks like this:

#!/bin/bash
set -euo pipefail

dmg=$(mktemp -t deutschlandgpt).dmg
curl -fsL -o "$dmg" https://www.deutschlandgpt.de/api/desktop/download/darwin

mount=$(mktemp -d)
hdiutil attach "$dmg" -nobrowse -quiet -mountpoint "$mount"

# Only install if the app is signed by us
team=$(codesign -dv --verbose=4 "$mount/DeutschlandGPT.app" 2>&1 \
  | awk -F= '/TeamIdentifier/ {print $2}')
[ "$team" = "XT228V86UU" ] || { echo "Unexpected team ID: $team"; exit 1; }

ditto "$mount/DeutschlandGPT.app" /Applications/DeutschlandGPT.app

hdiutil detach "$mount" -quiet
rm -f "$dmg"

The team ID check is not decoration. It is what Installomator otherwise does for you, and the reason this script refuses to install a swapped file.

Verifying signature and notarisation

On a device, check the installed app like this:

# Signature and team ID
codesign -dv --verbose=4 /Applications/DeutschlandGPT.app 2>&1 \
  | grep -E "TeamIdentifier|Authority"

# Have Apple confirm notarisation
spctl --assess --type execute -vv /Applications/DeutschlandGPT.app

Expect TeamIdentifier=XT228V86UU and a confirmation reading source=Notarized Developer ID. spctl queries Apple, so it needs an internet connection.

Why there is no PKG

macOS ships as a DMG only. Installomator consumes a DMG directly, which covers the Jamf Pro case, and it saves an extra packaging step on every release.

If parts of your fleet run without Installomator and you genuinely need a PKG, talk to us and we will look at it.

Automatic updates

Whether the app updates itself on a managed Mac depends on whether the signed-in user may write to the application bundle. How that works and how to disable updates by policy is on Controlling updates.