Software catalog and self-service

View as Markdown Open in ChatGPT Open in Claude

The software catalog lists the applications Outpost can install on your endpoints. Each entry says where the application comes from, how it installs quietly, and how Outpost checks afterwards that it is there. From the catalog you deploy software, offer it in the tray so people can install it themselves, and require or block it by profile. This page explains the catalog and shows how to add an entry and handle self-service requests.

Before you begin

To add or change catalog entries you need software:manage. To approve or deny requests you need software:approve. Viewing needs software:read.
On the MSP plan, open the client’s workspace first. An entry you add there belongs to that client. The built-in entries are offered to every client.

Sources

Each catalog entry has one Source:

Source	Platform	Package id or URL
winget	Windows	The winget package id, such as `Mozilla.Firefox`
Chocolatey	Windows	The Chocolatey package id
Uploaded installer	Windows	None. You upload an `.msi` or `.exe` for each version.
Vendor URL	Windows	The vendor’s download URL for an `.msi`
apt (Debian, Ubuntu)	Linux	The package name, such as `vlc`
dnf (RHEL, Alma, Rocky, Fedora)	Linux	The package name, such as `git`
Homebrew (macOS)	macOS (Preview)	A formula, such as `jq`, or a cask as `cask:google-chrome`
Mac installer (.pkg or .dmg)	macOS (Preview)	An `https` URL, plus the file’s SHA-256
Manifest	None	Outpost does not deploy manifest entries in this version.

winget installs need winget on the endpoint, which most Windows Server releases do not include. Homebrew installs run as the account that owns Homebrew on the Mac, and fail if Homebrew is not installed. A Mac installer whose download does not match the pinned SHA-256 is deleted and nothing is installed.

The catalog comes with built-in entries: common Windows applications from winget, Linux packages from apt and dnf, and a few macOS casks from Homebrew. They carry the Built-in chip. You cannot delete a built-in entry. To stop offering one in the tray, turn off Offer it in the tray on it.

Add software to the catalog

Go to Software > Catalog and select Add software.
Under What it is, enter the Name, and optionally the Publisher, Category, Description, and Tags.
Under Where it comes from, choose the Source and enter the Package id or URL. For Mac installer (.pkg or .dmg), also enter the SHA-256. You cannot change the source or the package id after the entry is created.
In License, choose Free or Licensed.
Select Offer it in the tray to list the entry in self-service on endpoints. Select Ask a technician first so that selecting it in the tray opens a request instead of installing.
Under How it installs, enter the Silent switches and Uninstall switches the installer needs, any Exit codes that mean success, and a Timeout (seconds). Left empty, the exit codes that mean success are 0 for an .exe, and 0, 3010, and 1641 for an .msi.
Optionally, select Let endpoints upgrade it themselves, or enter a version in Hold the fleet at version. Only one of the two can be set.
Under How Outpost checks it worked, select Add a check and choose a Check: Registry value, Registry key exists, File exists, File version at least, or Package installed (Linux or Homebrew). Every check must pass after the installer finishes. Detection, not the exit code, decides whether an install succeeded.
Select Save.
For an Uploaded installer, open the entry again, select Upload an installer under Versions, enter the Version exactly as the vendor writes it, choose the Installer file, and upload it. Endpoints download the file from your Outpost and check its SHA-256 before running it.

To stop offering an entry, select Retire on it. It is no longer offered for new installs or in the tray. Software already installed stays, and past deployments keep their records.

Self-service in the tray

An entry with Offer it in the tray appears in the self-service list of the Outpost tray app on endpoints. What happens when someone selects it:

Entry	Result
Free, without Ask a technician first	It installs straight away.
Ask a technician first, or Licensed	It opens a request, and a ticket from that person, for a technician to decide. A Licensed entry always asks, because allocating a paid seat is a decision for a person.

Approve or deny a request

Go to Software > Requests. Each request shows when it was Requested, Who asked, the Application, Why they asked, and its State: Waiting, Approved, or Denied.
Select Approve or Deny on the request.
For an approval, optionally enter a Note (optional). For a denial, enter a Reason, which is required.
Select Approve or Deny in the dialog.

Your note or reason is posted as a reply on the request’s ticket. On Enterprise and MSP, which include the service desk, that is how the person hears the decision. An approved request installs the next time the endpoint checks in. If the endpoint is offline, the install waits for it and expires after three days.

Require or block software

Two profile settings keep software present or absent. Each takes a list of catalog package ids or package source references, such as Mozilla.Firefox.

Setting	What Outpost does
`software.required_packages`	Installs each listed package on endpoints whose inventory does not show it.
`software.blocked_packages`	Removes each listed package from endpoints whose inventory shows it, and refuses a deployment that would install it.

Both lists combine across every profile that applies, so a narrower scope can add to them and cannot drop an entry a wider scope set. Removing software is never refused by the blocked list.

A blocked entry that no package manager owns, such as an uploaded installer, is removed through the uninstall entry the endpoint reported in its inventory. Outpost uses the first machine-wide install whose name contains the catalog entry’s Name. An endpoint with no such entry, for example one where the app is installed only per user, is skipped and nothing is sent to it. See Create and assign a profile and the Software settings.

Remove unapproved software

The catalog also records whether each title is allowed on your endpoints. The Approval column on Software > Catalog and on Software > Inventory shows one of three values:

Value	Meaning on endpoints with `software.uninstall_unapproved` on
Approved	Kept. Catalog entries you add are approved.
Not allowed	Removed.
Unreviewed	Removed 7 days after Outpost first sees it on the endpoint, unless it is approved first. A title found installed that matches no catalog entry is unreviewed.

To decide about a title, select Approve or Not allowed on its row in either list. You need software:manage. Marking a title found on endpoints adds it to the catalog as an entry that cannot be installed or offered in the tray. It only records the decision.

Nothing is removed until a profile turns on software.uninstall_unapproved for the endpoint. Then:

Packages in software.required_packages are always kept.
Only applications the endpoint can uninstall are removed: machine-wide Windows applications with an uninstall entry, and macOS apps that are not from Apple. Linux packages, Homebrew packages, and per-user installs are never removed this way.
An unreviewed title waiting out its 7 days shows Pending removal on followed by the date on the endpoint’s Software tab.
Every removal is recorded in the audit log.

Review what is installed before you turn the setting on, so the 7-day grace does not remove software people need. See the Software settings.

See what is installed

Software > Inventory lists every install on the client’s endpoints, one row per install, with its Version, Publisher, Scope (Machine wide or Per user), Endpoint, First seen, and Last seen. Narrow it to a product to see which endpoints have it and at which version. Software that is no longer reported stays listed as Removed, so a license audit can see when it went.

Verify

Open the entry in Software > Catalog. Its chips show Self-service when it is offered in the tray and Needs approval when it asks first. On an endpoint, the tray’s self-service list includes it.

Next steps

Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.