---
title: "Software catalog and self-service"
description: "Add applications to the software catalog, offer them in the tray, approve self-service requests, and require or block software by profile."
url: "https://support.outpostplatform.com/automation/software/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "The Outpost software catalog under Software > Catalog. Sources are winget, Chocolatey, uploaded installers, and vendor MSI URLs on Windows, apt and dnf on Linux, Homebrew and pinned .pkg or .dmg on macOS (Preview). Entries can be offered in the tray, gated by approval through Software > Requests, and required or blocked by profile. Needs software:manage."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "software:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/automation/software.md"
license: "CC BY 4.0"
---

# Software catalog and self-service

The software catalog lists the applications Outpost can install on your
endpoints. Each entry says where the application comes from, how it installs
quietly, and how Outpost checks afterwards that it is there. From the catalog
you deploy software, offer it in the tray so people can install it themselves,
and require or block it by profile. This page explains the catalog and shows how
to add an entry and handle self-service requests.

## Before you begin

- To add or change catalog entries you need `software:manage`. To approve or
  deny requests you need `software:approve`. Viewing needs `software:read`.
- On the MSP plan, open the client's workspace first. An entry you add there
  belongs to that client. The built-in entries are offered to every client.

## Sources

Each catalog entry has one **Source**:

| Source | Platform | **Package id or URL** |
| --- | --- | --- |
| **winget** | Windows | The winget package id, such as `Mozilla.Firefox` |
| **Chocolatey** | Windows | The Chocolatey package id |
| **Uploaded installer** | Windows | None. You upload an `.msi` or `.exe` for each version. |
| **Vendor URL** | Windows | The vendor's download URL for an `.msi` |
| **apt (Debian, Ubuntu)** | Linux | The package name, such as `vlc` |
| **dnf (RHEL, Alma, Rocky, Fedora)** | Linux | The package name, such as `git` |
| **Homebrew (macOS)** | macOS (Preview) | A formula, such as `jq`, or a cask as `cask:google-chrome` |
| **Mac installer (.pkg or .dmg)** | macOS (Preview) | An `https` URL, plus the file's **SHA-256** |
| **Manifest** | None | Outpost does not deploy manifest entries in this version. |

winget installs need winget on the endpoint, which most Windows Server releases
do not include. Homebrew installs run as the account that owns Homebrew on the
Mac, and fail if Homebrew is not installed. A Mac installer whose download does
not match the pinned SHA-256 is deleted and nothing is installed.

The catalog comes with built-in entries: common Windows applications from
winget, Linux packages from apt and dnf, and a few macOS casks from Homebrew.
They carry the **Built-in** chip. You cannot delete a built-in entry. To stop
offering one in the tray, turn off **Offer it in the tray** on it.

## Add software to the catalog

1. Go to **Software** > **Catalog** and select **Add software**.
2. Under **What it is**, enter the **Name**, and optionally the **Publisher**,
   **Category**, **Description**, and **Tags**.
3. Under **Where it comes from**, choose the **Source** and enter the **Package
   id or URL**. For **Mac installer (.pkg or .dmg)**, also enter the
   **SHA-256**. You cannot change the source or the package id after the entry
   is created.
4. In **License**, choose **Free** or **Licensed**.
5. Select **Offer it in the tray** to list the entry in self-service on
   endpoints. Select **Ask a technician first** so that selecting it in the tray
   opens a request instead of installing.
6. Under **How it installs**, enter the **Silent switches** and **Uninstall
   switches** the installer needs, any **Exit codes that mean success**, and a
   **Timeout (seconds)**. Left empty, the exit codes that mean success are `0`
   for an `.exe`, and `0`, `3010`, and `1641` for an `.msi`.
7. Optionally, select **Let endpoints upgrade it themselves**, or enter a
   version in **Hold the fleet at version**. Only one of the two can be set.
8. Under **How Outpost checks it worked**, select **Add a check** and choose a
   **Check**: **Registry value**, **Registry key exists**, **File exists**,
   **File version at least**, or **Package installed (Linux or Homebrew)**. Every
   check must pass after the installer finishes. Detection, not the exit code,
   decides whether an install succeeded.
9. Select **Save**.
10. For an **Uploaded installer**, open the entry again, select **Upload an
    installer** under **Versions**, enter the **Version** exactly as the vendor
    writes it, choose the **Installer** file, and upload it. Endpoints download
    the file from your Outpost and check its SHA-256 before running it.

:::note
Uploaded installers are stored in your storage destination. Home Lab uses your
own S3-compatible storage only, so add one before you upload. See
[Storage destinations](/depot/storage/) and
[Plans and limits](/account/plans-and-limits/).
:::

To stop offering an entry, select **Retire** on it. It is no longer offered for
new installs or in the tray. Software already installed stays, and past
deployments keep their records.

## Self-service in the tray

An entry with **Offer it in the tray** appears in the self-service list of the
[Outpost tray app](/tray/) on endpoints. What happens when someone selects it:

| Entry | Result |
| --- | --- |
| **Free**, without **Ask a technician first** | It installs straight away. |
| **Ask a technician first**, or **Licensed** | It opens a request, and a ticket from that person, for a technician to decide. A **Licensed** entry always asks, because allocating a paid seat is a decision for a person. |

### Approve or deny a request

1. Go to **Software** > **Requests**. Each request shows when it was
   **Requested**, **Who** asked, the **Application**, **Why** they asked, and its
   **State**: **Waiting**, **Approved**, or **Denied**.
2. Select **Approve** or **Deny** on the request.
3. For an approval, optionally enter a **Note (optional)**. For a denial, enter
   a **Reason**, which is required.
4. Select **Approve** or **Deny** in the dialog.

Your note or reason is posted as a reply on the request's ticket. On
Enterprise and MSP, which include the [service desk](/service-desk/), that is
how the person hears the decision. An approved request installs the next time the endpoint checks in. If
the endpoint is offline, the install waits for it and expires after three days.

## Require or block software

Two profile settings keep software present or absent. Each takes a list of
catalog package ids or package source references, such as `Mozilla.Firefox`.

| Setting | What Outpost does |
| --- | --- |
| `software.required_packages` | Installs each listed package on endpoints whose inventory does not show it. |
| `software.blocked_packages` | Removes each listed package from endpoints whose inventory shows it, and refuses a deployment that would install it. |

Both lists combine across every profile that applies, so a narrower scope can
add to them and cannot drop an entry a wider scope set. Removing software is
never refused by the blocked list.

A blocked entry that no package manager owns, such as an uploaded installer,
is removed through the uninstall entry the endpoint reported in its inventory.
Outpost uses the first machine-wide install whose name contains the catalog
entry's **Name**. An endpoint with no such entry, for example one where the app
is installed only per user, is skipped and nothing is sent to it. See
[Create and assign a profile](/automation/create-a-profile/) and the
[Software settings](/automation/policy-settings/#software).

## Remove unapproved software

The catalog also records whether each title is allowed on your endpoints. The
**Approval** column on **Software** > **Catalog** and on **Software** >
**Inventory** shows one of three values:

| Value | Meaning on endpoints with `software.uninstall_unapproved` on |
| --- | --- |
| **Approved** | Kept. Catalog entries you add are approved. |
| **Not allowed** | Removed. |
| **Unreviewed** | Removed 7 days after Outpost first sees it on the endpoint, unless it is approved first. A title found installed that matches no catalog entry is unreviewed. |

To decide about a title, select **Approve** or **Not allowed** on its row in
either list. You need `software:manage`. Marking a title found on endpoints
adds it to the catalog as an entry that cannot be installed or offered in the
tray. It only records the decision.

Nothing is removed until a profile turns on `software.uninstall_unapproved`
for the endpoint. Then:

- Packages in `software.required_packages` are always kept.
- Only applications the endpoint can uninstall are removed: machine-wide
  Windows applications with an uninstall entry, and macOS apps that are not
  from Apple. Linux packages, Homebrew packages, and per-user installs are
  never removed this way.
- An unreviewed title waiting out its 7 days shows **Pending removal on**
  followed by the date on the endpoint's **Software** tab.
- Every removal is recorded in the audit log.

Review what is installed before you turn the setting on, so the 7-day grace
does not remove software people need. See the
[Software settings](/automation/policy-settings/#software).

## See what is installed

**Software** > **Inventory** lists every install on the client's endpoints, one
row per install, with its **Version**, **Publisher**, **Scope** (**Machine
wide** or **Per user**), **Endpoint**, **First seen**, and **Last seen**. Narrow
it to a product to see which endpoints have it and at which version. Software
that is no longer reported stays listed as **Removed**, so a license audit can
see when it went.

## Verify

Open the entry in **Software** > **Catalog**. Its chips show **Self-service**
when it is offered in the tray and **Needs approval** when it asks first. On an
endpoint, the tray's self-service list includes it.

## Next steps

- [Deploy software](/automation/deploy-software/)
- [Patching](/automation/patching/)
- [Vulnerabilities](/automation/vulnerabilities/)