Ship the software you build like everything else.
Software Publishing delivers your company's internal tools and apps from private repositories, through the same catalog, policies, and updates as the rest of your software. The credentials they need stay secret all the way to the device.
- $20 / device / month on the Business plan
- Also included with the Enterprise plan
The problem
Internal tools are usually the hardest software to get onto a laptop. They live in a private repository, need a token to download, and get passed around as install scripts in a README. Tokens end up in shell profiles, versions fall out of step, and nobody can say who's running what.
What you get
Ship internal tools from your own repositories.
Connect private repositories on GitHub or GitLab, and the tools and apps in them become installable across your fleet, the same way as anything in the public catalog. There's no separate packaging pipeline, and nothing is published outside your company.
Push a commit, and the fleet follows.
Workbrew syncs each repository's default branch and picks up every new commit, so releasing a new version is a merge, not a project. Devices see the new version the next time they check in.
Credentials that never touch a disk.
Installs that need a token to fetch private artifacts get it from a secret configuration. The value is masked in console lists, held only in memory on each device, and passed to the installs Workbrew runs, never to a user's shell.
How it works
Connect a private GitHub repository through the Workbrew GitHub App, or a GitLab one over OAuth. Workbrew syncs its formulae and casks and makes them available to the devices you choose.
If an install needs a credential, store it as a secret configuration. Each device keeps it in memory and hands it only to the installs Workbrew runs, so the token does its job and is never written to a file.
Frequently Asked Questions
On GitHub, connected through the Workbrew GitHub App, or on GitLab, connected over OAuth. Workbrew syncs each repository's default branch and picks up new commits automatically, and you can sync on demand.
End users never do. Secret configurations aren't written to any file on the device or passed on the command line, and they're only given to the installs Workbrew runs, not to a user's terminal. In the console, values are masked in lists, and administrators can still see them when editing. How secret configurations stay secret has the details.
Software Publishing is part of Business and Enterprise. Business starts with a free 14-day trial.
Try Business free
Publish your own software to the fleet with a 14-day trial.