diff --git a/ext/installfiles/mac/get-proxy-settings.sh b/ext/installfiles/mac/get-proxy-settings.sh
index 873a8558b..16ba0b472 100755
--- a/ext/installfiles/mac/get-proxy-settings.sh
+++ b/ext/installfiles/mac/get-proxy-settings.sh
@@ -5,9 +5,9 @@
 
 export PATH=/bin:/usr/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/sbin
 
-enabled=`system_profiler SPNetworkDataType|grep "HTTP Proxy Enabled"|awk {'sub(/^.*:[ \t]*/, "", $0); print $0;'}`
-port=`system_profiler SPNetworkDataType|grep "HTTP Proxy Port"|awk {'sub(/^.*:[ \t]*/, "", $0); print $0;'}`
-serv=`system_profiler SPNetworkDataType|grep "HTTP Proxy Server"|awk {'sub(/^.*:[ \t]*/, "", $0); print $0;'}`
+enabled=`system_profiler SPNetworkDataType|grep "HTTP Proxy Enabled"|awk {'sub(/^.*:[ \t]*/, "", $0); print $0;'} 2>/dev/null`
+port=`system_profiler SPNetworkDataType|grep "HTTP Proxy Port"|awk {'sub(/^.*:[ \t]*/, "", $0); print $0;'} 2>/dev/null`
+serv=`system_profiler SPNetworkDataType|grep "HTTP Proxy Server"|awk {'sub(/^.*:[ \t]*/, "", $0); print $0;'} 2>/dev/null`
 
 if [ "$enabled" = "Yes" ]; then
 	if [ "$serv" ]; then
diff --git a/make-mac.mk b/make-mac.mk
index 717cbccb3..4ad4c5ad5 100644
--- a/make-mac.mk
+++ b/make-mac.mk
@@ -13,18 +13,13 @@ OBJS+=osdep/OSXEthernetTap.o
 CODESIGN=echo
 CODESIGN_CERT=
 
+# For internal use only -- signs everything with ZeroTier's developer cert
 ifeq ($(ZT_OFFICIAL_RELEASE),1)
-	# For use by ZeroTier Networks -- sign with developer cert
-	ZT_AUTO_UPDATE=1
-	DEFS+=-DZT_OFFICIAL_RELEASE 
+	DEFS+=-DZT_OFFICIAL_RELEASE -DZT_AUTO_UPDATE 
 	CODESIGN=codesign
 	CODESIGN_CERT="Developer ID Application: ZeroTier Networks LLC (8ZD9JUCZ4V)"
 endif
 
-ifeq ($(ZT_AUTO_UPDATE),1)
-	DEFS+=-DZT_AUTO_UPDATE 
-endif
-
 # Build with ZT_ENABLE_NETWORK_CONTROLLER=1 to build with the Sqlite network controller
 ifeq ($(ZT_ENABLE_NETWORK_CONTROLLER),1)
 	DEFS+=-DZT_ENABLE_NETWORK_CONTROLLER 
@@ -35,6 +30,7 @@ endif
 # Enable SSE-optimized Salsa20 -- all Intel macs support SSE2
 DEFS+=-DZT_SALSA20_SSE
 
+# Debug mode -- dump trace output, build binary with -g
 ifeq ($(ZT_DEBUG),1)
 	DEFS+=-DZT_TRACE 
 	CFLAGS=-Wall -g -pthread $(INCLUDES) $(DEFS)
@@ -63,10 +59,18 @@ selftest: $(OBJS) selftest.o
 	$(CXX) $(CXXFLAGS) -o zerotier-selftest selftest.o $(OBJS) $(LIBS)
 	$(STRIP) zerotier-selftest
 
-sign-pkg: FORCE
+# Requires Packages: http://s.sudre.free.fr/Software/Packages/about.html
+mac-dist-pkg: FORCE
+	cd ext/installfiles/mac ; packagesbuild "ZeroTier One.pkgproj"
 	$(CODESIGN) -f -s $(CODESIGN_CERT) "ZeroTier One.pkg"
 	$(CODESIGN) -vvv "ZeroTier One.pkg"
 
+# For internal use only
+official: FORCE
+	make clean
+	make -j 4 ZT_OFFICIAL_RELEASE=1
+	make ZT_OFFICIAL_RELEASE=1 mac-dist-pkg
+
 clean:
 	rm -rf *.dSYM build-* *.pkg *.dmg *.o node/*.o controller/*.o service/*.o osdep/*.o ext/http-parser/*.o ext/lz4/*.o ext/json-parser/*.o zerotier-one zerotier-idtool zerotier-selftest zerotier-cli ZeroTierOneInstaller-*
 
diff --git a/one.cpp b/one.cpp
index 4a0a57e89..f2d7970b1 100644
--- a/one.cpp
+++ b/one.cpp
@@ -888,6 +888,9 @@ static void printHelp(const char *cn,FILE *out)
 {
 	fprintf(out,"ZeroTier One version %d.%d.%d"ZT_EOL_S"(c)2011-2015 ZeroTier, Inc."ZT_EOL_S,ZEROTIER_ONE_VERSION_MAJOR,ZEROTIER_ONE_VERSION_MINOR,ZEROTIER_ONE_VERSION_REVISION);
 	fprintf(out,"Licensed under the GNU General Public License v3"ZT_EOL_S""ZT_EOL_S);
+	std::string updateUrl(OneService::autoUpdateUrl());
+	if (updateUrl.length())
+		fprintf(out,"Automatic update enabled:"ZT_EOL_S"  %s"ZT_EOL_S""ZT_EOL_S,updateUrl.c_str());
 	fprintf(out,"Usage: %s [-switches] [home directory]"ZT_EOL_S""ZT_EOL_S,cn);
 	fprintf(out,"Available switches:"ZT_EOL_S);
 	fprintf(out,"  -h                - Display this help"ZT_EOL_S);
diff --git a/service/OneService.cpp b/service/OneService.cpp
index a566449fa..c2ea034bc 100644
--- a/service/OneService.cpp
+++ b/service/OneService.cpp
@@ -96,6 +96,8 @@ namespace ZeroTier { typedef BSDEthernetTap EthernetTap; }
 
 namespace ZeroTier {
 
+namespace {
+
 class OneServiceImpl;
 
 static int SnodeVirtualNetworkConfigFunction(ZT1_Node *node,void *uptr,uint64_t nwid,enum ZT1_VirtualNetworkConfigOperation op,const ZT1_VirtualNetworkConfig *nwconf);
@@ -903,6 +905,8 @@ static int ShttpOnMessageComplete(http_parser *parser)
 	return 0;
 }
 
+} // anonymous namespace
+
 std::string OneService::platformDefaultHomePath()
 {
 #ifdef __UNIX_LIKE__
@@ -939,6 +943,30 @@ std::string OneService::platformDefaultHomePath()
 #endif // __UNIX_LIKE__ or not...
 }
 
+std::string OneService::autoUpdateUrl()
+{
+#ifdef ZT_AUTO_UPDATE
+
+/*
+#if defined(__LINUX__) && ( defined(__i386__) || defined(__x86_64) || defined(__x86_64__) || defined(__amd64) || defined(__i386) )
+	if (sizeof(void *) == 8)
+		return "http://download.zerotier.com/ZeroTierOneInstaller-linux-x64-LATEST.nfo";
+	else return "http://download.zerotier.com/ZeroTierOneInstaller-linux-x86-LATEST.nfo";
+#endif
+*/
+
+#if defined(__APPLE__) && ( defined(__i386__) || defined(__x86_64) || defined(__x86_64__) || defined(__amd64) || defined(__i386) )
+	return "http://download.zerotier.com/update/mac_intel/LATEST.nfo";
+#endif
+
+#ifdef __WINDOWS__
+	return "http://download.zerotier.com/update/win_intel/LATEST.nfo";
+#endif
+
+#endif // ZT_AUTO_UPDATE
+	return std::string();
+}
+
 OneService *OneService::newInstance(const char *hp,unsigned int port,const char *overrideRootTopology) { return new OneServiceImpl(hp,port,overrideRootTopology); }
 OneService::~OneService() {}
 
diff --git a/service/OneService.hpp b/service/OneService.hpp
index 33c405474..aea314f59 100644
--- a/service/OneService.hpp
+++ b/service/OneService.hpp
@@ -34,6 +34,15 @@ namespace ZeroTier {
 
 /**
  * Local service for ZeroTier One as system VPN/NFV provider
+ *
+ * If built with ZT_ENABLE_NETWORK_CONTROLLER defined, this includes and
+ * runs controller/SqliteNetworkController with a database called
+ * controller.db in the specified home directory.
+ *
+ * If built with ZT_AUTO_UPDATE, an official ZeroTier update URL is
+ * periodically checked and updates are automatically downloaded, verified
+ * against a built-in list of update signing keys, and installed. This is
+ * only supported for certain platforms.
  */
 class OneService
 {
@@ -69,6 +78,11 @@ public:
 	 */
 	static std::string platformDefaultHomePath();
 
+	/**
+	 * @return Auto-update URL or empty string if auto-updates unsupported or not enabled
+	 */
+	static std::string autoUpdateUrl();
+
 	/**
 	 * Create a new instance of the service
 	 *