Updating an app replaces software you already trust with a new build. A safer update process verifies where the new build came from, whether macOS can validate it, whether it fits your Mac, and whether it is actually newer. No single check proves that software is bug-free, but several independent checks can catch common mistakes.
Developer identity
Comparing the signing identity on the installed app and the downloaded update helps catch a package signed by a different developer. It’s a consistency check; a compromised developer account can still produce maliciously signed software.
Notarization and download integrity
Apple notarization means Apple’s automated service scanned software submitted by a developer and found no known malicious components at that time. A feed signature or checksum can also confirm the downloaded file matches what the app’s update source published. They answer related but different questions.
Compatibility and version checks
The update should support the Mac’s installed macOS version and processor architecture. The updater should also compare versions rather than assume that any downloaded package is a newer release.
Keep a recovery path
When possible, retain the old app until the replacement launches or passes a final validation check. If the final step fails, restoring the previous copy can be easier than finding and reinstalling it manually.
Current combines these checks for supported updates and can restore the prior app if its final check fails. For official platform details, see Apple’s macOS notarization documentation and Gatekeeper and runtime protection guide.