Security Validation of the Patch My PC Application Catalog

At Patch My PC, we understand that IT Security is vital to your organization, especially when considering a third-party patch management solution. We want to ensure you understand how we validate the integrity of the third-party updates included in our catalog.

The security validation of the updates and applications you deploy from Patch My PC products to your environment is extremely important. As such, the following is a detailed procedure of how we ensure the quality and integrity of the patches we publish in our third-party software update catalog.

The Patch My PC application catalog is a catalog of third-party applications and updates that Patch My PC maintains. Our team adds applications continuously and ensures that existing applications are updated over time as third-parties release application updates.

What is the Patch My PC application catalog?

The applications and updates we collect and support are available for deployment in your environment. You deploy the applications and updates using either the on-premise Publisher for Configuration Manager and Intune or through Patch My PC Cloud for Intune.

Topics covered in this article:

Step 1: Building the Catalog
Step 2: Check for Third-Party Updates
Step 3: Check the File Hash
Step 4: Run Through Virus Total
Step 5: Verify Updates are Digitally Signed
Step 6: Upload the Signed Catalog to Secure Storage
Patch My PC Unsigned Apps Table

Step 1: Building the Catalog

The Patch My PC Application Catalog contains applications for which there is a publicly accessible download of the installer that we can deploy and update. The catalog also includes some applications that do not publish a publicly accessible download. These are typically applications that you need to pay for, the installer is behind a paywall that requires an individual login and password, or the vendor uses a compressed file for its installer. We refer to such apps as binary-free applications.

In either case, Patch My PC engineers compile these third-party applications from vendors into our catalog and update them as vendors produce updates. This process includes downloading the update binary (EXE, MSI, or MSP) from the official vendor’s download mirror. This update binary will be the file executed on client computers to update the product. Again, if an application is binary-free, Patch My PC supports some of these, however, it is up to you, the customer, to pay for or log in to the vendor to get the update.

This process happens repeatedly for applications. For example, in February 2025, Patch My PC engineers added almost 100 new applications to our catalog and updated 1200 of the over 2000 applications we currently support. Customers are welcome to submit ideas for new applications to add to the Patch My PC catalog as long as an application meets specific criteria we use to add applications to our catalog.

Step 2: Checking for Third-Party Updates

The next part in the process of security validation of the Patch My PC Application Catalog is to check for third-party updates. Thus, we scan the third-party vendors’ applications we support and pick up updates when they are released.

When we add new updates to our catalog, the catalog metadata gets exported and saved into a CAB file. This catalog (.CAB) is imported into your environment and used to publish updates.

Again, this process of checking vendors for third-party updates happens continuously throughout the day and is why we recommend syncing daily with our products.

Step 3: Check the File Hash

The next step in the security validation process is to verify the digest we have for an application update matches one that was provided from the vendor.

What is a file hash?

A file hash is a unique, fixed-length string of characters generated by applying a mathematical algorithm to the contents of a file. Essentially, hashes are the output of an algorithm that verifies that the contents of the file are actually that specific file.

In other words, when Patch My PC engineers review a third-party update we’ve picked up, they make sure that the file hash we have for the update matches the one that the vendor released.

Step 4: Run Through Virus Total

Once we obtain the vendor’s binary and file hash, we then upload the binary to VirusTotal. VirusTotal will analyze the binary file through 55+ anti-virus engines. We post all VirusTotal results for any third-party updates released in our RSS feed and Catalog Release newsletter.

It is important to note that VirusTotal has a 650MB limit for file uploads, therefore, Patch My PC is not able to scan updates larger than 650MB with VirusTotal. For file uploads that exceed the VirusTotal limit, we check for viruses with Windows Defender. This accounts for roughly twenty percent of our current catalog.

Step 5: Verify Updates are Digitally Signed

Before the catalog metadata is evaluated for publishing, there is a digital signature check on the downloaded catalog file. This check validates the catalog is signed from Patch My PC.

When an updated binary is downloaded, we compare the hash of the downloaded binary with the hash from the catalog and only publish the update if they match.

It is important to understand that some applications are not digitally signed. For those applications, we compare against the vendor’s hash when possible. However, if an application is not signed, we get the application hash from GitHub and run it through Virus Total to make sure. A simple example is 7-Zip.

You can view a list of applications that are not digitally signed at the end of this article.

Step 6: Upload the Signed Catalog to Secure Storage

Once the catalog is validated, only then will the catalog metadata be evaluated for processing. Since we don’t control the servers used for content downloads, it’s essential to ensure the file downloaded from the vendor’s website is the exact same file used when initially creating the update that went through the VirusTotal scans.

To ensure the integrity of the catalog when downloaded and imported to your environment, we code-sign the catalog file with our code-signing certificate. The certificate is hardware-based and tightly controlled to only a few vetted and trusted individuals within Patch My PC. 

When the catalog gets downloaded into your environment, the import will only occur in our publishing service, SCCM 1806+, or SCUP if the catalog is code-signed from a trusted publisher.

After all the previous steps have been completed, we upload the signed catalog to secure storage, so only Patch My PC can connect to the storage. This is where the catalog is hosted.

When Patch My PC Publisher or Patch My PC Cloud needs to access the catalog, they download the cab file via https where it is served to customers.

Learn more about the security validation of the Patch My PC Publisher or Patch My PC Cloud.

As mentioned earlier, some applications are not digitally signed. For those applications, we get the application hash from GitHub and run it through Virus Total to make sure. Below is the list of applications this applies to.