When a Mac app replaces itself with a newer version, one of four machines is doing the work, and they have very different answers to the question that matters: how do you know the thing you just installed is the thing the developer shipped?
The four machines
The App Storeupdates apps in the background, with Apple checking the signature and hosting the download. It is the safest path and the least available one for system monitors: sandboxed apps can’t touch fans and can’t see other processes’ network traffic, which is why most tools in this category live outside it.
Sparkleis the open-source framework most indie Mac apps ship, Stats among them (it’s right there in the project’s dependencies). Done properly it verifies each update against a key the app carries. Done lazily it’s a prompt on every launch, which is most people’s mental image of “Mac app update” and not a flattering one.
Homebrew updates from the command line: brew upgrade pulls the new cask, checks its recorded hash, and swaps the app. The strength is that you asked for it; nothing happens on its own schedule. The weakness is remembering to ask.
Doing it yourself is the fourth machine, and the one where the safety question has teeth, because the app is downloading its own replacement and copying it over itself with no store and no framework in the loop.
An update mechanism is a place where an app asks for trust it already spent.
What Readout does, and why
Readout took the fourth path in 0.6.0, with rules. The daily check asks GitHub whether a newer version exists and posts one notification when one first appears: once per version, never a repeat. Nothing downloads until you click. When you do, it fetches the release, verifies the new bundle is signed by the same developer identity as the running copy, and refuses a mismatch; only then does it swap the app and relaunch. Fan control approval survives the update, because macOS binds that approval to the same identity it just verified.
And if your copy came from Homebrew, the update button doesn’t pretend otherwise: it hands you brew upgrade, because two machines managing one app is how installs rot. An app with a privileged fan helper has no business replacing itself unattended. It should also be honest about which machine is in charge.