How iKnowMyMac updates TunnelBear

How it finds the update

1. Reads the developer's Sparkle update feed, including its release channels and the minimum macOS version for each build.
2. Downloads the build the feed offers from the developer's own server.
3. Checks the feed's EdDSA signature on the download whenever the developer publishes a signing key.

Checked before every install

• The code signature is valid and Gatekeeper accepts it, notarized if your copy was.
• It's signed by the same developer (team ID) as the copy you have. A change of developer asks you first.
• It's never signed worse than your copy, and never an older version.
• Your current copy is kept as a backup first, so Undo Last Update puts it back in one step.
• An app that's open is never quit for you: it updates when you quit it.