1. A method comprising: downloading manifest data for an update into a client device, the manifest data comprising a plurality of attributes for the update including a location where the update is stored; determining whether the manifest data is valid by validating a signature of the manifest data stored in the manifest data; based on the manifest data being valid, downloading, separately from the downloading of the manifest data, the update to software from the location determined from the validated manifest data and based on a determination using the manifest data that the update is applicable; validating a signature of the update to the software stored in the manifest data after the downloading of the update; storing the update into a machine-readable medium; revalidating the signature of the update to the software after the storing and prior to installation of the update to the software; and installing, using one or more processors, the update to the software on the client device, in response to a determination that the signature of the update is validated after receipt and revalidated prior to installation.