Sparkle hosting
on your own Cloudflare.

What it does.

The whole workflow is two commands.

npx alpha-gate deploy --instance myalpha
  └ sets up the database, storage, and both Workers in your account.
    Safe to re-run. Needs no custom domain, DNS, or API token.

npx alpha-gate publish MyApp.dmg --channel beta
  └ reads the version from the app, signs the update on your Mac
    (the key stays in your Keychain), and publishes it to the channel.
  → #1502 · v1.3.0-beta.2 live on beta

If you’d rather not use the terminal, the back office has an upload page. CI can publish too, with a service token.

Seeing who gets what.

The back office, as it actually looks. These screenshots come from a local instance with five testers and three builds.

Choose a back-office page

The overview What each channel serves, who receives it, and anything that needs attention, with the remedy one click away. Testers Every tester’s next check, answered before their app asks: gets #1502, up to date, pinned, revoked, no channel yet. Builds Every publish, with its channels, downloads, and update counts. Withdraw a bad build or mark one critical from here. Channels beta, stable, or whatever you name them. A channel serves its highest linked build to everyone on it. Changes that would leave someone without updates ask first. Activity Every check, download, and update as it happens, filterable by tester, event, and build. Audit Every admin action in a hash-chained log: who did what and to whom, and whether the chain still matches its anchor.

screenshots LightDark

<?xml version="1.0" encoding="utf-8"?><rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">  <channel>    <title>MyApp</title>    <!-- generated 2026-07-12T00:41:03Z for ana@example.com -->    <item>      <title>1.3.0-beta.2</title>      <sparkle:version>1502</sparkle:version>      <sparkle:shortVersionString>1.3.0-beta.2</sparkle:shortVersionString>      <enclosure       url="https://alpha-gate-myalpha.acme.workers.dev/download?token=9J7K2M4T…&amp;via=update"       length="48211457"       type="application/octet-stream"       sparkle:edSignature="mDp5Gv…J8wQ==" />      <!-- verified by Sparkle against your public key ✓ -->    </item>  </channel></rss>

every admin action: 9f31c2 → 5b07aa → e91d44 → c2a871 → anchored

Everything you do in the back office is written to an audit log. The log is hash-chained and anchored daily to storage that can’t be overwritten, so tampering shows. If the login check fails for any reason, the request is rejected. A CI token can only upload builds.

How it works.

Wiring it into your app.

Your Sparkle setup stays standard. The one difference: the feed URL carries the tester’s token, so the app builds it at runtime. One delegate method:

func feedURLString(for updater: SPUUpdater) -> String? {
    guard let token = Keychain.token else { return nil }   // not activated yet
    return "https://<your-app-host>/appcast?token=\(token)"
}

The token arrives when the tester clicks their link: it opens myapp://activate?token=… through your app’s URL scheme, and you store it in the Keychain. Keep a paste field on first launch for people who prefer to copy the key. The token can’t ship inside the binary, because changing a notarized app breaks its seal.

In Info.plist you add your Sparkle public key and the URL scheme, and leave SUFeedURL unset, since there is no single feed. A second delegate method can report the installed build number; that is what fills the who-runs-what table in the back office.

If you revoke a tester, their next check shows a note asking them to renew access. Reactivate them and updates resume, with no reinstall. The full checklist is in the uploading guide.

You own all of it.

This is the point of Alpha Gate. Your testers, your builds, and your signing keys stay with you: the keys on your Mac, everything else in your Cloudflare account. Nothing is shared with anyone, and there is nothing to subscribe to. It runs on Cloudflare’s free workers.dev addresses out of the box, or behind your own domain if you’d rather.

what crosses the boundary: archive bytes + one signature string — produced at publish time, on your machine

backup = one SQL file · teardown = one command · many isolated instances per account

One command backs everything up as a single SQL file. Teardown archives the database first, then removes it all and tells you about the two steps that still need the Cloudflare dashboard.

Trade-offs.

Open source.

The code is on GitHub. It’s a small TypeScript project: two Workers, a deploy CLI, and a test suite that runs offline, so developing needs no Cloudflare account. Issues and pull requests are welcome.

github.com/alex-ivanov/alpha-gate →